@lamalibre/create-lamaste 4.0.0

package/vendor/serverd/src/routes/onboarding/provision.js

@@ -0,0 +1,327 @@
+import { EventEmitter } from 'node:events';
+import crypto from 'node:crypto';
+import { execa } from 'execa';
+import { CHISEL_RELEASE } from '@lamalibre/lamaste';
+import { getConfig, updateConfig } from '../../lib/config.js';
+import * as chisel from '../../lib/chisel.js';
+import * as authelia from '../../lib/authelia.js';
+import * as certbot from '../../lib/certbot.js';
+import * as nginx from '../../lib/nginx.js';
+import { writeInvitePage } from '../../lib/invite-page.js';
+import { migrateChiselCredentialsIfNeeded } from '../../lib/chisel-users.js';
+import { loadAgentRegistry } from '../../lib/mtls.js';
+import { setChiselRunningPinnedRelease } from '../../lib/chisel-runtime.js';
+
+// Module-level state for provisioning
+const emitter = new EventEmitter();
+emitter.setMaxListeners(50);
+
+const TASK_DEFINITIONS = [
+  { id: 'install-chisel', title: 'Starting Chisel' },
+  { id: 'install-authelia', title: 'Configuring Authelia' },
+  { id: 'issue-certs', title: 'Issuing TLS certificates' },
+  { id: 'configure-nginx', title: 'Configuring nginx' },
+  { id: 'verify-services', title: 'Verifying services' },
+  { id: 'finalize', title: 'Finalizing setup' },
+];
+
+let provisioningState = {
+  isRunning: false,
+  tasks: TASK_DEFINITIONS.map((t) => ({ ...t, status: 'pending', message: null, log: null })),
+  error: null,
+  result: null,
+};
+
+/**
+ * Reset provisioning state for a fresh run.
+ */
+function resetState() {
+  provisioningState = {
+    isRunning: true,
+    tasks: TASK_DEFINITIONS.map((t) => ({ ...t, status: 'pending', message: null, log: null })),
+    error: null,
+    result: null,
+  };
+}
+
+/**
+ * Emit a progress event and update the provisioning state.
+ */
+function emitProgress(taskId, status, message, log = null) {
+  const taskIndex = provisioningState.tasks.findIndex((t) => t.id === taskId);
+  if (taskIndex !== -1) {
+    provisioningState.tasks[taskIndex].status = status;
+    provisioningState.tasks[taskIndex].message = message;
+    if (log !== null) {
+      provisioningState.tasks[taskIndex].log = log;
+    }
+  }
+
+  const current =
+    provisioningState.tasks.filter((t) => t.status === 'done').length +
+    (status === 'running' ? 1 : 0);
+
+  const payload = {
+    task: taskId,
+    title: provisioningState.tasks[taskIndex]?.title || taskId,
+    status,
+    message,
+    log,
+    progress: { current, total: TASK_DEFINITIONS.length },
+  };
+
+  emitter.emit('progress', payload);
+}
+
+/**
+ * Run the full provisioning sequence.
+ */
+async function runProvisioning(log) {
+  const config = getConfig();
+  const { domain, email } = config;
+
+  let adminPassword;
+
+  try {
+    // Step 1: Chisel. create-lamaste installed the pinned binary and its
+    // unit (as root); the panel creates the key and the authfile and starts
+    // the service.
+    emitProgress('install-chisel', 'running', 'Checking the Chisel installation...');
+    if (!(await chisel.isChiselInstalled())) {
+      throw new Error(
+        'Chisel is not installed. Run `npx @lamalibre/create-lamaste` on the server to repair the installation.',
+      );
+    }
+    const chiselVersion = await chisel.getInstalledChiselVersion();
+    await chisel.ensureChiselKey();
+    // Initialise the chisel-users authfile before starting the service.
+    // On a fresh install the registry is empty, so it holds only the
+    // no-grants sentinel user (chisel authenticates, and rejects every
+    // connection until an agent is enrolled). On re-provisioning over an
+    // existing install it preserves any prior credentials.
+    emitProgress('install-chisel', 'running', 'Initialising chisel-users authfile...');
+    await migrateChiselCredentialsIfNeeded(loadAgentRegistry, log);
+    emitProgress('install-chisel', 'running', 'Starting Chisel service...');
+    await chisel.startChisel();
+    setChiselRunningPinnedRelease(chiselVersion === CHISEL_RELEASE.version);
+    emitProgress('install-chisel', 'done', `Chisel ${chiselVersion ?? ''} running`.trim());
+
+    // Step 2: Authelia. Installed by create-lamaste (it runs as its own
+    // unprivileged account); the panel writes its configuration and starts it.
+    emitProgress('install-authelia', 'running', 'Checking the Authelia installation...');
+    if (!(await authelia.isAutheliaInstalled())) {
+      throw new Error(
+        'Authelia is not installed. Run `npx @lamalibre/create-lamaste` on the server to repair the installation.',
+      );
+    }
+    emitProgress('install-authelia', 'running', 'Writing configuration...');
+
+    const secrets = {
+      jwtSecret: crypto.randomBytes(32).toString('hex'),
+      sessionSecret: crypto.randomBytes(32).toString('hex'),
+      storageEncryptionKey: crypto.randomBytes(32).toString('hex'),
+    };
+    await authelia.writeAutheliaConfig(domain, secrets);
+
+    emitProgress('install-authelia', 'running', 'Creating admin user...');
+    adminPassword = crypto.randomBytes(16).toString('base64url');
+    await authelia.createUser('admin', adminPassword);
+
+    emitProgress('install-authelia', 'running', 'Starting Authelia service...');
+    await authelia.startAuthelia();
+    emitProgress('install-authelia', 'done', 'Authelia configured and running');
+
+    // Step 3: Issue certificates
+    emitProgress('issue-certs', 'running', `Issuing certificate for panel.${domain}...`);
+    await certbot.issueCoreCerts(domain, email);
+    emitProgress('issue-certs', 'running', 'Setting up auto-renewal...');
+    await certbot.setupAutoRenew();
+    emitProgress('issue-certs', 'done', 'TLS certificates issued');
+
+    // Step 4: Configure nginx
+    emitProgress('configure-nginx', 'running', 'Writing panel vhost...');
+    await nginx.writePanelVhost(domain);
+
+    emitProgress('configure-nginx', 'running', 'Writing auth vhost...');
+    await nginx.writeAuthVhost(domain);
+
+    emitProgress('configure-nginx', 'running', 'Writing tunnel vhost...');
+    await nginx.writeTunnelVhost(domain);
+
+    emitProgress('configure-nginx', 'running', 'Writing invitation page...');
+    await writeInvitePage();
+
+    emitProgress('configure-nginx', 'running', 'Enabling sites...');
+    await nginx.enableSite('lamalibre-lamaste-panel-domain');
+    await nginx.enableSite('lamalibre-lamaste-auth');
+    await nginx.enableSite('lamalibre-lamaste-tunnel');
+
+    emitProgress('configure-nginx', 'running', 'Testing nginx configuration...');
+    const testResult = await nginx.testConfig();
+    if (!testResult.valid) {
+      throw new Error(`nginx configuration test failed: ${testResult.error}`);
+    }
+
+    emitProgress('configure-nginx', 'running', 'Reloading nginx...');
+    await nginx.reload();
+    emitProgress('configure-nginx', 'done', 'nginx configured and reloaded');
+
+    // Step 5: Verify services
+    emitProgress('verify-services', 'running', 'Checking Chisel...');
+    const chiselRunning = await chisel.isChiselRunning();
+    if (!chiselRunning) {
+      throw new Error('Chisel service is not running after provisioning');
+    }
+
+    emitProgress('verify-services', 'running', 'Checking Authelia...');
+    const autheliaRunning = await authelia.isAutheliaRunning();
+    if (!autheliaRunning) {
+      throw new Error('Authelia service is not running after provisioning');
+    }
+
+    emitProgress('verify-services', 'running', 'Checking nginx...');
+    try {
+      const { stdout } = await execa('systemctl', ['is-active', 'nginx']);
+      if (stdout.trim() !== 'active') {
+        throw new Error('nginx is not active');
+      }
+    } catch {
+      throw new Error('nginx service is not running after provisioning');
+    }
+
+    emitProgress('verify-services', 'running', 'Checking panel server...');
+    try {
+      const { stdout } = await execa('curl', ['-s', 'http://127.0.0.1:3100/api/health']);
+      const health = JSON.parse(stdout);
+      if (health.status !== 'ok') {
+        throw new Error('Panel server health check returned unexpected status');
+      }
+    } catch (err) {
+      throw new Error(`Panel server health check failed: ${err.message}`);
+    }
+    emitProgress('verify-services', 'done', 'All services running');
+
+    // Step 6: Finalize
+    emitProgress('finalize', 'running', 'Updating configuration...');
+    await updateConfig({ onboarding: { status: 'COMPLETED' } });
+
+    const result = {
+      adminUsername: 'admin',
+      adminPassword,
+      panelUrl: `https://panel.${domain}`,
+      authUrl: `https://auth.${domain}`,
+    };
+
+    provisioningState.result = result;
+    provisioningState.isRunning = false;
+    emitProgress('finalize', 'done', 'Provisioning complete');
+
+    // Send the completion event
+    emitter.emit('progress', {
+      task: 'complete',
+      status: 'done',
+      message: 'Provisioning complete',
+      result,
+      progress: { current: TASK_DEFINITIONS.length, total: TASK_DEFINITIONS.length },
+    });
+  } catch (err) {
+    const failedTask = provisioningState.tasks.find((t) => t.status === 'running');
+    const failedTaskId = failedTask?.id || 'unknown';
+
+    if (failedTask) {
+      failedTask.status = 'error';
+      failedTask.message = err.message;
+    }
+
+    provisioningState.error = { task: failedTaskId, message: err.message };
+    provisioningState.isRunning = false;
+
+    emitter.emit('progress', {
+      task: failedTaskId,
+      status: 'error',
+      message: `Failed: ${failedTask?.title || failedTaskId}`,
+      error: err.message,
+      progress: {
+        current: provisioningState.tasks.filter((t) => t.status === 'done').length,
+        total: TASK_DEFINITIONS.length,
+      },
+    });
+
+    log.error({ err, task: failedTaskId }, 'Provisioning failed');
+  } finally {
+    // Clear sensitive data from memory after clients have had time to receive it.
+    // This runs on both success and error paths to prevent password leaks.
+    setTimeout(() => {
+      adminPassword = undefined;
+      if (provisioningState.result) {
+        provisioningState.result.adminPassword = null;
+      }
+    }, 5000);
+  }
+}
+
+export default async function provisionRoute(fastify, _opts) {
+  // POST /provision — start provisioning
+  fastify.post('/provision', async (request, reply) => {
+    const config = getConfig();
+    const { status } = config.onboarding;
+
+    if (status === 'FRESH' || status === 'DOMAIN_SET') {
+      return reply.code(409).send({
+        error: 'DNS must be verified before provisioning',
+      });
+    }
+
+    if (status === 'COMPLETED') {
+      return reply.code(410).send({
+        error: 'Onboarding already completed',
+      });
+    }
+
+    // If provisioning is actively running, return 409
+    if (provisioningState.isRunning) {
+      return reply.code(409).send({
+        error: 'Provisioning already in progress',
+      });
+    }
+
+    // Set status to PROVISIONING
+    await updateConfig({ onboarding: { status: 'PROVISIONING' } });
+
+    // Reset state and start provisioning in the background
+    resetState();
+    runProvisioning(request.log);
+
+    return reply.code(202).send({ ok: true, message: 'Provisioning started' });
+  });
+
+  // WebSocket /provision/stream — real-time progress
+  fastify.get('/provision/stream', { websocket: true }, (socket, _request) => {
+    // Send current state immediately for late-joining clients
+    socket.send(
+      JSON.stringify({
+        type: 'state',
+        ...provisioningState,
+      }),
+    );
+
+    // Subscribe to progress events
+    function onProgress(payload) {
+      try {
+        socket.send(JSON.stringify(payload));
+      } catch {
+        // Client disconnected — handled by close event
+      }
+    }
+
+    emitter.on('progress', onProgress);
+
+    socket.on('close', () => {
+      emitter.off('progress', onProgress);
+    });
+
+    socket.on('error', () => {
+      emitter.off('progress', onProgress);
+    });
+  });
+}

package/vendor/serverd/src/routes/onboarding/status.js

@@ -0,0 +1,12 @@
+import { getConfig } from '../../lib/config.js';
+
+export default async function statusRoute(fastify, _opts) {
+  fastify.get('/status', async (_request, _reply) => {
+    const config = getConfig();
+    return {
+      status: config.onboarding.status,
+      domain: config.domain ?? null,
+      ip: config.ip,
+    };
+  });
+}

package/vendor/serverd/src/routes/plugin-router.js

@@ -0,0 +1,79 @@
+/**
+ * Server-side plugin router — delegates to pluginHostPlugin from @lamalibre/lamaste.
+ *
+ * Configures the core plugin host with:
+ *   - mTLS auth strategy (two-level encapsulation)
+ *   - Per-plugin auth hook: admits admin certs unconditionally, or
+ *     agent / plugin-agent certs that hold at least one
+ *     `plugin:<pluginName>:*` capability. Per-route capability specifics
+ *     (e.g. `plugin:rodeo:run` vs `plugin:rodeo:submit`) remain each
+ *     plugin's responsibility via its own preHandlers.
+ *   - Server paths (/etc/lamalibre/lamaste/)
+ *   - Storage config resolution per plugin
+ *   - Onboarding guard (503 before onboarding completes)
+ */
+import { pluginHostPlugin } from '@lamalibre/lamaste';
+import { readPlugins } from '../lib/plugins.js';
+import { getPluginStorageConfig } from '../lib/storage.js';
+import { getConfig } from '../lib/config.js';
+import { getCaPaths } from '../lib/pki-paths.js';
+import { managementOnly } from '../middleware/onboarding-guard.js';
+
+const STATE_DIR = process.env.LAMALIBRE_LAMASTE_STATE_DIR || '/etc/lamalibre/lamaste';
+const PLUGINS_DIR = `${STATE_DIR}/plugins`;
+
+export default async function pluginRouter(fastify) {
+  // Block all plugin routes until onboarding is complete
+  fastify.addHook('onRequest', managementOnly());
+
+  await fastify.register(pluginHostPlugin, {
+    baseDir: STATE_DIR,
+    pluginsDataDir: PLUGINS_DIR,
+    readRegistry: readPlugins,
+    auth: 'mtls',
+    authHookFactory: (pluginName) => {
+      const allowedPrefix = `plugin:${pluginName}:`;
+      return async (request, reply) => {
+        const role = request.certRole;
+        if (role === 'admin') return;
+
+        if (role === 'agent' || role === 'plugin-agent') {
+          const caps = request.certCapabilities || [];
+          if (caps.some((c) => c.startsWith(allowedPrefix))) {
+            return;
+          }
+        }
+
+        return reply.code(403).send({
+          error: 'Insufficient scope for plugin route',
+          details: {
+            required: `admin OR agent with at least one "${allowedPrefix}*" capability`,
+            current: role ?? 'unknown',
+          },
+        });
+      };
+    },
+
+    /**
+     * Resolve per-plugin register options: always injects `lamasteCa`
+     * ({ certPath, keyPath }) so plugins (e.g. rodeo) can reuse Lamaste's
+     * CA for mTLS; adds `storage` only when the plugin has bound storage.
+     */
+    resolvePluginOptions: async (plugin) => {
+      const panelConfig = getConfig();
+      const base = {
+        lamasteCa: getCaPaths(),
+      };
+
+      const storageConfig = await getPluginStorageConfig(plugin.name);
+      if (storageConfig) {
+        base.storage = {
+          ...storageConfig,
+          prefix: panelConfig.serverId,
+        };
+      }
+
+      return base;
+    },
+  });
+}