@lamalibre/create-lamaste 4.0.0

package/src/tasks/nginx.js

@@ -0,0 +1,265 @@
+import { execa } from 'execa';
+import { writeFile, unlink } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { ensureHttpRedirect } from '../lib/http-redirect.js';
+
+/**
+ * nginx IP-based mTLS configuration subtasks.
+ *
+ * @param {object} ctx  Shared installer context.
+ * @param {object} task Parent Listr2 task reference.
+ * @returns {import('listr2').ListrTask[]}
+ */
+export function nginxTasks(ctx, task) {
+  const pkiDir = ctx.pkiDir;
+
+  return task.newListr([
+    {
+      title: 'Generating self-signed TLS certificate for IP access',
+      task: async (_ctx, subtask) => {
+        subtask.output = `Generating self-signed cert for IP ${ctx.ip}...`;
+        await execa('openssl', [
+          'req',
+          '-x509',
+          '-nodes',
+          '-days',
+          '3650',
+          '-newkey',
+          'rsa:2048',
+          '-keyout',
+          `${pkiDir}/self-signed-key.pem`,
+          '-out',
+          `${pkiDir}/self-signed.pem`,
+          '-subj',
+          `/CN=${ctx.ip}/O=Lamaste`,
+          '-addext',
+          `subjectAltName=IP:${ctx.ip}`,
+        ]);
+
+        await execa('chmod', ['600', `${pkiDir}/self-signed-key.pem`]);
+        await execa('chmod', ['644', `${pkiDir}/self-signed.pem`]);
+
+        subtask.output = 'Self-signed TLS certificate generated';
+      },
+      rendererOptions: { persistentOutput: true },
+    },
+    {
+      title: 'Writing mTLS snippet',
+      task: async (_ctx, subtask) => {
+        const snippetsDir = '/etc/nginx/snippets';
+        if (!existsSync(snippetsDir)) {
+          await execa('mkdir', ['-p', snippetsDir]);
+        }
+
+        const mtlsSnippet = `ssl_client_certificate ${pkiDir}/ca.crt;
+ssl_verify_client optional;
+`;
+        await writeFile('/etc/nginx/snippets/lamalibre-lamaste-mtls.conf', mtlsSnippet);
+
+        subtask.output = 'mTLS snippet written to /etc/nginx/snippets/lamalibre-lamaste-mtls.conf';
+      },
+      rendererOptions: { persistentOutput: true },
+    },
+    {
+      title: 'Writing IP-based panel vhost',
+      task: async (_ctx, subtask) => {
+        const vhostConfig = `# Rate limit zone for public enrollment endpoint (5 requests/minute per IP)
+limit_req_zone $binary_remote_addr zone=enroll:1m rate=5r/m;
+
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}
+
+server {
+    listen 9292 ssl;
+    server_name _;
+
+    ssl_certificate ${pkiDir}/self-signed.pem;
+    ssl_certificate_key ${pkiDir}/self-signed-key.pem;
+
+    include /etc/nginx/snippets/lamalibre-lamaste-mtls.conf;
+
+    # SSL settings
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers HIGH:!aNULL:!MD5;
+    ssl_prefer_server_ciphers on;
+
+    # Show certificate help page when client cert is missing or invalid
+    error_page 495 496 /cert-help.html;
+    location = /cert-help.html {
+        root /opt/lamalibre/lamaste/lamaste-server-ui;
+        internal;
+    }
+
+    # Proxy to serverd (mTLS required — reject if cert missing or invalid)
+    location / {
+        if ($ssl_client_verify != SUCCESS) {
+            return 496;
+        }
+        proxy_pass http://127.0.0.1:3100;
+
+        # Client cert headers — set from nginx TLS variables, never passed through from client
+        proxy_set_header X-SSL-Client-Verify $ssl_client_verify;
+        proxy_set_header X-SSL-Client-DN $ssl_client_s_dn;
+        proxy_set_header X-SSL-Client-Serial $ssl_client_serial;
+
+        # Strip Authelia identity headers — not trusted on mTLS vhost
+        proxy_set_header Remote-User "";
+        proxy_set_header Remote-Groups "";
+        proxy_set_header Remote-Name "";
+        proxy_set_header Remote-Email "";
+
+        # Standard proxy headers
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # Public API paths (no mTLS verification check).
+    # ssl_verify_client is 'optional' at server level, so TLS handshake
+    # succeeds without a cert. These locations skip the $ssl_client_verify
+    # check and clear cert headers so the backend sees no client identity.
+    location /api/enroll {
+        limit_req zone=enroll burst=5 nodelay;
+        proxy_pass http://127.0.0.1:3100;
+        proxy_http_version 1.1;
+
+        # Clear cert headers so the backend sees no client cert
+        proxy_set_header X-SSL-Client-Verify "";
+        proxy_set_header X-SSL-Client-DN "";
+        proxy_set_header X-SSL-Client-Serial "";
+
+        # Strip Authelia identity headers — not trusted on public endpoint
+        proxy_set_header Remote-User "";
+        proxy_set_header Remote-Groups "";
+        proxy_set_header Remote-Name "";
+        proxy_set_header Remote-Email "";
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location /api/invite {
+        proxy_pass http://127.0.0.1:3100;
+        proxy_http_version 1.1;
+
+        proxy_set_header X-SSL-Client-Verify "";
+        proxy_set_header X-SSL-Client-DN "";
+        proxy_set_header X-SSL-Client-Serial "";
+
+        # Strip Authelia identity headers — not trusted on public endpoint
+        proxy_set_header Remote-User "";
+        proxy_set_header Remote-Groups "";
+        proxy_set_header Remote-Name "";
+        proxy_set_header Remote-Email "";
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # API paths with WebSocket upgrade support (mTLS required)
+    location /api {
+        if ($ssl_client_verify != SUCCESS) {
+            return 496;
+        }
+        proxy_pass http://127.0.0.1:3100;
+        proxy_http_version 1.1;
+
+        # Client cert headers — set from nginx TLS variables, never passed through from client
+        proxy_set_header X-SSL-Client-Verify $ssl_client_verify;
+        proxy_set_header X-SSL-Client-DN $ssl_client_s_dn;
+        proxy_set_header X-SSL-Client-Serial $ssl_client_serial;
+
+        # Strip Authelia identity headers — not trusted on mTLS vhost
+        proxy_set_header Remote-User "";
+        proxy_set_header Remote-Groups "";
+        proxy_set_header Remote-Name "";
+        proxy_set_header Remote-Email "";
+
+        # Standard proxy headers
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # WebSocket: only upgrade when client requests it
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+    }
+}
+`;
+        await writeFile('/etc/nginx/sites-available/lamalibre-lamaste-panel-ip', vhostConfig);
+
+        subtask.output = 'Vhost written to /etc/nginx/sites-available/lamalibre-lamaste-panel-ip';
+      },
+      rendererOptions: { persistentOutput: true },
+    },
+    {
+      title: 'Enabling site and cleaning up defaults',
+      task: async (_ctx, subtask) => {
+        // Create symlink
+        await execa('ln', [
+          '-sf',
+          '/etc/nginx/sites-available/lamalibre-lamaste-panel-ip',
+          '/etc/nginx/sites-enabled/lamalibre-lamaste-panel-ip',
+        ]);
+
+        // Remove only the default site from sites-enabled (preserve other existing sites)
+        const defaultSite = '/etc/nginx/sites-enabled/default';
+        if (existsSync(defaultSite)) {
+          await unlink(defaultSite).catch(() => {});
+          subtask.output = 'Site enabled, default removed';
+        } else {
+          subtask.output = 'Site enabled';
+        }
+      },
+      rendererOptions: { persistentOutput: true },
+    },
+    {
+      title: 'Redirecting plain HTTP to HTTPS',
+      task: async (_ctx, subtask) => {
+        // nginx is (re)started by the next task; no reload here. Not fatal:
+        // another site on this machine may already own port 80's default
+        // server, and the relay works without the redirect.
+        try {
+          await ensureHttpRedirect({ reload: false });
+          subtask.output = 'Port 80 answers every host with a redirect to https://';
+        } catch (err) {
+          subtask.skip(`Skipped — ${err.message}`);
+        }
+      },
+      rendererOptions: { persistentOutput: true },
+    },
+    {
+      title: 'Validating and starting nginx',
+      task: async (_ctx, subtask) => {
+        subtask.output = 'Validating nginx configuration...';
+        try {
+          await execa('nginx', ['-t']);
+        } catch (error) {
+          throw new Error(
+            `nginx configuration validation failed:\n${error.stderr || error.message}`,
+          );
+        }
+
+        subtask.output = 'Enabling and starting nginx...';
+        await execa('systemctl', ['enable', 'nginx']);
+        await execa('systemctl', ['restart', 'nginx']);
+
+        const { stdout: status } = await execa('systemctl', ['is-active', 'nginx']);
+        if (status.trim() !== 'active') {
+          throw new Error(`nginx failed to start. Status: ${status.trim()}`);
+        }
+
+        subtask.output = 'nginx is running and listening on port 9292';
+      },
+      rendererOptions: { persistentOutput: true },
+    },
+  ]);
+}

package/src/tasks/node.js

@@ -0,0 +1,110 @@
+import { execa } from 'execa';
+import { unlink } from 'node:fs/promises';
+
+const REQUIRED_MAJOR = 22;
+
+/**
+ * Node.js 22 LTS installation subtasks.
+ *
+ * 22.5+ is the minimum because lamaste-serverd uses the built-in
+ * `node:sqlite` module (which requires 22.5+).
+ *
+ * @param {object} ctx  Shared installer context.
+ * @param {object} task Parent Listr2 task reference.
+ * @returns {import('listr2').ListrTask[]}
+ */
+export function nodeTasks(ctx, task) {
+  return task.newListr([
+    {
+      title: 'Checking existing Node.js installation',
+      task: async (_ctx, subtask) => {
+        try {
+          const { stdout } = await execa('node', ['--version']);
+          const version = stdout.trim();
+          const major = parseInt(version.replace(/^v/, ''), 10);
+
+          if (major >= REQUIRED_MAJOR) {
+            ctx.nodeAlreadyInstalled = true;
+            subtask.output = `Node.js ${version} found, skipping install`;
+          } else {
+            subtask.output = `Node.js ${version} found (below v${REQUIRED_MAJOR}), will upgrade`;
+          }
+        } catch {
+          subtask.output = `Node.js not found, installing v${REQUIRED_MAJOR} LTS`;
+        }
+      },
+      rendererOptions: { persistentOutput: true },
+    },
+    {
+      title: 'Installing NodeSource repository',
+      skip: () => ctx.nodeAlreadyInstalled && `Node.js ${REQUIRED_MAJOR}+ already installed`,
+      task: async (_ctx, subtask) => {
+        const setupScript = '/tmp/nodesource_setup.sh';
+
+        subtask.output = 'Downloading NodeSource setup script...';
+        try {
+          await execa('curl', [
+            '-fsSL',
+            `https://deb.nodesource.com/setup_${REQUIRED_MAJOR}.x`,
+            '-o',
+            setupScript,
+          ]);
+        } catch (error) {
+          throw new Error(
+            `Failed to download NodeSource setup script. Check your internet connection.\n${error.stderr || error.message}`,
+          );
+        }
+
+        subtask.output = 'Running NodeSource setup...';
+        try {
+          await execa('bash', [setupScript]);
+        } catch (error) {
+          throw new Error(`NodeSource setup script failed.\n${error.stderr || error.message}`);
+        }
+
+        await unlink(setupScript).catch(() => {});
+        subtask.output = 'NodeSource repository added';
+      },
+      rendererOptions: { persistentOutput: true },
+    },
+    {
+      title: `Installing Node.js ${REQUIRED_MAJOR} LTS`,
+      skip: () => ctx.nodeAlreadyInstalled && `Node.js ${REQUIRED_MAJOR}+ already installed`,
+      task: async (_ctx, subtask) => {
+        subtask.output = 'Running apt-get install nodejs...';
+        try {
+          await execa('apt-get', ['install', '-y', 'nodejs']);
+        } catch (error) {
+          throw new Error(
+            `Failed to install Node.js. Try running 'apt-get update' manually and retrying.\n${error.stderr || error.message}`,
+          );
+        }
+        subtask.output = 'Node.js installed';
+      },
+      rendererOptions: { persistentOutput: true },
+    },
+    {
+      title: 'Verifying Node.js installation',
+      task: async (_ctx, subtask) => {
+        const { stdout: nodeVersion } = await execa('node', ['--version']);
+        const { stdout: npmVersion } = await execa('npm', ['--version']);
+
+        const trimmedNode = nodeVersion.trim();
+        const trimmedNpm = npmVersion.trim();
+        const major = parseInt(trimmedNode.replace(/^v/, ''), 10);
+
+        if (major < REQUIRED_MAJOR) {
+          throw new Error(
+            `Expected Node.js v${REQUIRED_MAJOR}+, got ${trimmedNode}. Installation may have failed.`,
+          );
+        }
+
+        ctx.nodeVersion = trimmedNode;
+        ctx.npmVersion = trimmedNpm;
+
+        subtask.output = `Node.js ${trimmedNode}, npm ${trimmedNpm}`;
+      },
+      rendererOptions: { persistentOutput: true },
+    },
+  ]);
+}