@lamalibre/create-lamaste 4.2.0 → 4.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (123) hide show
  1. package/package.json +2 -2
  2. package/scripts/lamaste-priv +205 -2
  3. package/src/index.js +4 -4
  4. package/src/lib/node-version.js +114 -0
  5. package/src/lib/relay-services.js +15 -1
  6. package/src/lib/service-config.js +113 -0
  7. package/src/tasks/gatekeeper.js +8 -3
  8. package/src/tasks/node.js +34 -75
  9. package/src/tasks/redeploy.js +36 -0
  10. package/vendor/docs/00-introduction/how-it-works.md +2 -2
  11. package/vendor/docs/00-introduction/quickstart.md +5 -5
  12. package/vendor/docs/00-introduction/what-is-lamaste.md +5 -5
  13. package/vendor/docs/01-concepts/authentication.md +6 -3
  14. package/vendor/docs/01-concepts/authorization.md +29 -17
  15. package/vendor/docs/01-concepts/certificates.md +3 -3
  16. package/vendor/docs/01-concepts/mtls.md +2 -2
  17. package/vendor/docs/01-concepts/nginx-reverse-proxy.md +8 -3
  18. package/vendor/docs/01-concepts/security-model.md +98 -34
  19. package/vendor/docs/01-concepts/tickets.md +2 -2
  20. package/vendor/docs/01-concepts/tunneling.md +4 -4
  21. package/vendor/docs/02-guides/agent-setup.md +34 -16
  22. package/vendor/docs/02-guides/certificate-management.md +2 -2
  23. package/vendor/docs/02-guides/cloud-provisioning.md +3 -3
  24. package/vendor/docs/02-guides/desktop-app-setup.md +10 -10
  25. package/vendor/docs/02-guides/installation.md +3 -3
  26. package/vendor/docs/02-guides/onboarding.md +2 -2
  27. package/vendor/docs/02-guides/standalone-plugin-with-tickets.md +2 -2
  28. package/vendor/docs/03-architecture/installer-flow.md +2 -2
  29. package/vendor/docs/03-architecture/installer.md +4 -4
  30. package/vendor/docs/03-architecture/management-flow.md +1 -1
  31. package/vendor/docs/03-architecture/nginx-configuration.md +91 -26
  32. package/vendor/docs/03-architecture/overview.md +8 -8
  33. package/vendor/docs/03-architecture/panel-client.md +6 -6
  34. package/vendor/docs/03-architecture/panel-server.md +2 -2
  35. package/vendor/docs/03-architecture/state-management.md +2 -2
  36. package/vendor/docs/03-architecture/system-overview.md +1 -1
  37. package/vendor/docs/04-api-reference/agent-hosted-plugins.md +407 -0
  38. package/vendor/docs/04-api-reference/app-host.md +360 -0
  39. package/vendor/docs/04-api-reference/audit-and-notifications.md +57 -0
  40. package/vendor/docs/04-api-reference/certificates.md +95 -38
  41. package/vendor/docs/04-api-reference/gatekeeper.md +5 -3
  42. package/vendor/docs/04-api-reference/lifecycle-hooks.md +333 -0
  43. package/vendor/docs/04-api-reference/onboarding.md +1 -1
  44. package/vendor/docs/04-api-reference/overview.md +137 -111
  45. package/vendor/docs/04-api-reference/registry-and-oidc.md +7 -3
  46. package/vendor/docs/04-api-reference/tunnels.md +15 -13
  47. package/vendor/docs/05-operations/backup-and-restore.md +1 -1
  48. package/vendor/docs/05-operations/uninstalling.md +1 -1
  49. package/vendor/docs/05-operations/upgrades.md +25 -20
  50. package/vendor/docs/06-reference/config-files.md +190 -97
  51. package/vendor/docs/06-reference/glossary.md +3 -3
  52. package/vendor/docs/06-reference/installer-flags.md +13 -13
  53. package/vendor/docs/06-reference/ports-and-services.md +1 -1
  54. package/vendor/docs/06-reference/troubleshooting.md +33 -8
  55. package/vendor/docs/_index.json +20 -0
  56. package/vendor/docs/gatekeeper-design.md +22 -19
  57. package/vendor/docs/identity-directory-design.md +57 -56
  58. package/vendor/docs/package.json +1 -1
  59. package/vendor/docs/todo/lib-cli-desktop-refactor.md +27 -27
  60. package/vendor/gatekeeper/dist/lib/types.d.ts +12 -0
  61. package/vendor/gatekeeper/dist/lib/types.d.ts.map +1 -1
  62. package/vendor/gatekeeper/dist/server/index.d.ts +2 -0
  63. package/vendor/gatekeeper/dist/server/index.d.ts.map +1 -1
  64. package/vendor/gatekeeper/dist/server/index.js +47 -8
  65. package/vendor/gatekeeper/dist/server/index.js.map +1 -1
  66. package/vendor/gatekeeper/dist/server/routes/authz.d.ts.map +1 -1
  67. package/vendor/gatekeeper/dist/server/routes/authz.js +233 -141
  68. package/vendor/gatekeeper/dist/server/routes/authz.js.map +1 -1
  69. package/vendor/gatekeeper/package.json +4 -3
  70. package/vendor/server/bin/lamaste-server.js +18 -1
  71. package/vendor/server/package.json +2 -2
  72. package/vendor/server/src/commands/audit.js +60 -0
  73. package/vendor/server/src/commands/plugins.js +963 -12
  74. package/vendor/server/src/commands/push-install.js +317 -0
  75. package/vendor/server/src/commands/registry-credential.js +2 -1
  76. package/vendor/server/src/commands/uninstall.js +28 -1
  77. package/vendor/server/src/ndjson.js +4 -2
  78. package/vendor/server/src/panel-api.js +32 -4
  79. package/vendor/server-ui/dist/assets/index-Bc5NCMSv.css +1 -0
  80. package/vendor/server-ui/dist/assets/index-DBp3cmaU.js +84 -0
  81. package/vendor/server-ui/dist/index.html +2 -2
  82. package/vendor/serverd/package.json +2 -2
  83. package/vendor/serverd/src/index.js +56 -4
  84. package/vendor/serverd/src/lib/actor.js +24 -0
  85. package/vendor/serverd/src/lib/agent-jobs.js +330 -0
  86. package/vendor/serverd/src/lib/app-error.js +10 -0
  87. package/vendor/serverd/src/lib/audit.js +145 -0
  88. package/vendor/serverd/src/lib/hook-effects.js +123 -0
  89. package/vendor/serverd/src/lib/hook-pipelines.js +902 -0
  90. package/vendor/serverd/src/lib/migrations/state/0006_plugin_agent.sql +4 -0
  91. package/vendor/serverd/src/lib/migrations/state/0007_audit_and_notifications.sql +29 -0
  92. package/vendor/serverd/src/lib/migrations/state/0008_plugin_hooks.sql +70 -0
  93. package/vendor/serverd/src/lib/migrations/state/0009_plugin_agent_half.sql +53 -0
  94. package/vendor/serverd/src/lib/migrations/state/0010_plugin_routes_and_retained_data.sql +47 -0
  95. package/vendor/serverd/src/lib/migrations/state/0011_agent_job_signature.sql +14 -0
  96. package/vendor/serverd/src/lib/mtls.js +89 -8
  97. package/vendor/serverd/src/lib/nginx.js +298 -44
  98. package/vendor/serverd/src/lib/notifications.js +107 -0
  99. package/vendor/serverd/src/lib/plugin-hooks.js +560 -0
  100. package/vendor/serverd/src/lib/plugin-hosting.js +688 -0
  101. package/vendor/serverd/src/lib/plugin-lifecycle.js +603 -0
  102. package/vendor/serverd/src/lib/plugin-operations.js +295 -0
  103. package/vendor/serverd/src/lib/plugin-packages.js +249 -0
  104. package/vendor/serverd/src/lib/plugins.js +298 -68
  105. package/vendor/serverd/src/lib/push-install.js +88 -2
  106. package/vendor/serverd/src/lib/relay-hooks.js +100 -0
  107. package/vendor/serverd/src/lib/relay-signing.js +43 -0
  108. package/vendor/serverd/src/lib/request-hooks.js +79 -0
  109. package/vendor/serverd/src/lib/retained-data.js +99 -0
  110. package/vendor/serverd/src/lib/trust-proxy.js +34 -0
  111. package/vendor/serverd/src/lib/tunnel-hooks.js +88 -0
  112. package/vendor/serverd/src/lib/vhost-reconcile.js +260 -0
  113. package/vendor/serverd/src/middleware/twofa-session.js +11 -1
  114. package/vendor/serverd/src/routes/agent-forwarder.js +37 -0
  115. package/vendor/serverd/src/routes/management/agent-panel-authz.js +97 -0
  116. package/vendor/serverd/src/routes/management/agents.js +262 -1
  117. package/vendor/serverd/src/routes/management/audit.js +81 -0
  118. package/vendor/serverd/src/routes/management/certs.js +1 -15
  119. package/vendor/serverd/src/routes/management/plugins.js +569 -54
  120. package/vendor/serverd/src/routes/management/tunnels.js +26 -0
  121. package/vendor/serverd/src/routes/management.js +4 -0
  122. package/vendor/server-ui/dist/assets/index-B5Wp8lu-.js +0 -257
  123. package/vendor/server-ui/dist/assets/index-BqWWFlTU.css +0 -1
package/vendor/docs/06-reference/config-files.md CHANGED
@@ -4,51 +4,71 @@
4
4
 
5
5
  ## File Overview
6
6
 
7
- | File | Format | Owner | Mode | Purpose |
8
- | ---------------------------------------------------------- | ---------- | ------------------------ | ---- | --------------------------------------------------------------------------------------------------- |
9
- | `/etc/lamalibre/lamaste/panel.json` | JSON | lamaste:lamaste | 0600 | Panel server configuration |
10
- | `/etc/lamalibre/lamaste/tunnels.json` | JSON | lamaste:lamaste | 0600 | Tunnel definitions |
11
- | `/etc/lamalibre/lamaste/sites.json` | JSON | lamaste:lamaste | 0600 | Static site definitions |
12
- | `/etc/lamalibre/lamaste/chisel-credentials.json` | JSON | lamaste:lamaste | 0600 | Per-agent Chisel credentials (source of truth for the authfile) |
13
- | `/etc/lamalibre/lamaste/chisel-users` | JSON | lamaste:lamaste-chisel | 0640 | Chisel `--authfile`: per-agent credentials and port grants (rendered) |
14
- | `/etc/lamalibre/lamaste/chisel-sentinel` | text | lamaste:lamaste | 0600 | Password of the `lamaste-no-grants` sentinel user |
15
- | `/etc/lamalibre/lamaste/chisel-server.key` | PEM | lamaste:lamaste-chisel | 0640 | Chisel SSH host key (`--keyfile`), generated by the panel at onboarding |
16
- | `/etc/authelia/configuration.yml` | YAML | lamaste:lamaste-authelia | 0640 | Authelia server configuration |
17
- | `/etc/authelia/users.yml` | YAML | lamaste:lamaste-authelia | 0660 | User database (Authelia rewrites it on a password change) |
18
- | `/etc/authelia/.secrets.json` | JSON | lamaste:lamaste-authelia | 0600 | Authelia secrets (panel only) |
19
- | `/etc/authelia/oidc-issuer.pem` | PEM | lamaste-authelia | 0600 | RSA-4096 key Authelia signs OIDC tokens with, written by `create-lamaste`; the panel cannot read it |
20
- | `/etc/lamalibre/lamaste/registry-credential.json` | JSON | lamaste:lamaste | 0600 | The panel's registry (Feria) credential: a pasted token, or the `lamaste-server` OIDC client |
21
- | `/etc/lamalibre/lamaste/oidc-clients.json` | JSON | lamaste:lamaste | 0600 | Plaintext secrets (and pbkdf2 salts) of confidential OIDC clients |
22
- | `/etc/lamalibre/lamaste/ticket-scopes.json` | JSON | lamaste:lamaste | 0600 | Ticket scope registry |
23
- | `/etc/lamalibre/lamaste/tickets.json` | JSON | lamaste:lamaste | 0600 | Ticket and session store |
24
- | `/etc/lamalibre/lamaste/invitations.json` | JSON | lamaste:lamaste | 0600 | Pending user invitations |
25
- | `/etc/lamalibre/lamaste/plugins.json` | JSON | lamaste:lamaste | 0600 | Plugin registry |
26
- | `/etc/lamalibre/lamaste/storage-config.json` | JSON | lamaste:lamaste | 0600 | Storage server registry and plugin bindings (credentials AES-256-GCM encrypted) |
27
- | `/etc/lamalibre/lamaste/storage-master.key` | Binary | lamaste:lamaste | 0600 | 32-byte master key for storage credential encryption |
28
- | `/etc/lamalibre/lamaste/groups.json` | JSON | lamaste:lamaste | 0600 | Lamaste group definitions and membership |
29
- | `/etc/lamalibre/lamaste/access-grants.json` | JSON | lamaste:lamaste | 0600 | Generic access grants (principal → resource) |
30
- | `/etc/lamalibre/lamaste/gatekeeper.json` | JSON | lamaste:lamaste | 0600 | Gatekeeper settings (cache TTL, admin contact, logging) |
31
- | `/etc/lamalibre/lamaste/access-request-log.json` | JSON | lamaste:lamaste | 0600 | Optional denied access log |
32
- | `/etc/lamalibre/lamaste/pki/enrollment-tokens.json` | JSON | lamaste:lamaste | 0600 | One-time enrollment tokens for hardware-bound enrollment |
33
- | `/etc/lamalibre/lamaste/pki/revoked.json` | JSON | lamaste:lamaste | 0600 | Revoked certificate serial numbers |
34
- | `/etc/lamalibre/lamaste/pki/agents/registry.json` | JSON | lamaste:lamaste | 0600 | Agent certificate metadata |
35
- | `/etc/nginx/sites-available/lamalibre-lamaste-*` | nginx conf | root:root | 0644 | Vhost configurations (the panel's are installed by `lamaste-priv`) |
36
- | `/etc/nginx/snippets/lamalibre-lamaste-mtls.conf` | nginx conf | root:root | 0644 | mTLS snippet |
37
- | `/etc/nginx/snippets/lamalibre-lamaste-authz-cache.conf` | nginx conf | root:root | 0644 | Gatekeeper proxy_cache zone |
38
- | `/etc/systemd/system/lamalibre-lamaste-gatekeeper.service` | systemd | root:root | 0644 | Gatekeeper systemd unit |
39
- | `/etc/systemd/system/chisel.service` | systemd | root:root | 0644 | Chisel unit, written by `create-lamaste` |
40
- | `/etc/systemd/system/authelia.service` | systemd | root:root | 0644 | Authelia unit, written by `create-lamaste` |
41
- | `~/.lamalibre/lamaste/servers.json` | JSON | user | 0600 | Desktop app server registry |
42
- | `~/.lamalibre/lamaste/agents.json` | JSON | user | 0600 | Multi-agent registry |
43
- | `~/.lamalibre/lamaste/agents/<label>/config.json` | JSON | user | 0600 | Per-agent configuration |
44
- | `~/.lamalibre/lamaste/agents/<label>/client.p12` | PKCS#12 | user | 0600 | Per-agent mTLS certificate |
45
- | `~/.lamalibre/lamaste/agents/<label>/ca.crt` | PEM | user | 0644 | Per-agent CA certificate |
46
- | `~/.lamalibre/lamaste/agents/<label>/chisel.json` | JSON | user | 0600 | Per-agent Chisel credential (source of truth for the service) |
47
- | `~/.lamalibre/lamaste/agents/<label>/chisel.env` | env file | user | 0600 | Linux only: `AUTH=` for the systemd unit's `EnvironmentFile=` |
48
- | `~/.lamalibre/lamaste/agents/<label>/` | directory | user | 0700 | Per-agent data directory |
49
- | `~/.lamalibre/lamaste/agents/<label>/sync-state.json` | JSON | user | 0600 | Outcome of the last `lamaste-agent sync` |
50
- | `~/.lamalibre/lamaste/agents/<label>/logs/` | directory | user | 0700 | Per-agent Chisel and sync log files |
51
- | `~/.lamalibre/lamaste/agent.json` | JSON | user | 0600 | Legacy single-server config |
7
+ | File | Format | Owner | Mode | Purpose |
8
+ | ------------------------------------------------------------------ | ---------- | ------------------------ | ---- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
9
+ | `/etc/lamalibre/lamaste/panel.json` | JSON | lamaste:lamaste | 0600 | Panel server configuration |
10
+ | `/etc/lamalibre/lamaste/tunnels.json` | JSON | lamaste:lamaste | 0600 | Tunnel definitions |
11
+ | `/etc/lamalibre/lamaste/sites.json` | JSON | lamaste:lamaste | 0600 | Static site definitions |
12
+ | `/etc/lamalibre/lamaste/chisel-credentials.json` | JSON | lamaste:lamaste | 0600 | Per-agent Chisel credentials (source of truth for the authfile) |
13
+ | `/etc/lamalibre/lamaste/chisel-users` | JSON | lamaste:lamaste-chisel | 0640 | Chisel `--authfile`: per-agent credentials and port grants (rendered) |
14
+ | `/etc/lamalibre/lamaste/chisel-sentinel` | text | lamaste:lamaste | 0600 | Password of the `lamaste-no-grants` sentinel user |
15
+ | `/etc/lamalibre/lamaste/chisel-server.key` | PEM | lamaste:lamaste-chisel | 0640 | Chisel SSH host key (`--keyfile`), generated by the panel at onboarding |
16
+ | `/etc/authelia/configuration.yml` | YAML | lamaste:lamaste-authelia | 0640 | Authelia server configuration |
17
+ | `/etc/authelia/users.yml` | YAML | lamaste:lamaste-authelia | 0660 | User database (Authelia rewrites it on a password change) |
18
+ | `/etc/authelia/.secrets.json` | JSON | lamaste:lamaste-authelia | 0600 | Authelia secrets (panel only) |
19
+ | `/etc/authelia/oidc-issuer.pem` | PEM | lamaste-authelia | 0600 | RSA-4096 key Authelia signs OIDC tokens with, written by `create-lamaste`; the panel cannot read it |
20
+ | `/etc/lamalibre/lamaste/registry-credential.json` | JSON | lamaste:lamaste | 0600 | The panel's registry (Feria) credential: a pasted token, or the `lamaste-server` OIDC client |
21
+ | `/etc/lamalibre/lamaste/oidc-clients.json` | JSON | lamaste:lamaste | 0600 | Plaintext secrets (and pbkdf2 salts) of confidential OIDC clients |
22
+ | `/etc/lamalibre/lamaste/relay-signing-key.json` | JSON | lamaste:lamaste | 0600 | Ed25519 key relay assertions (panel, Gatekeeper) and agents' app jobs (panel) are signed with |
23
+ | `/etc/lamalibre/lamaste/push-install-config.json` | JSON | lamaste:lamaste | 0600 | Push install: the switch, the policies, the default policy |
24
+ | `/etc/lamalibre/lamaste/push-install-sessions.json` | JSON | lamaste:lamaste | 0600 | Push install log (last 500 pushes) |
25
+ | `/etc/lamalibre/lamaste/ticket-scopes.json` | JSON | lamaste:lamaste | 0600 | Ticket scope registry |
26
+ | `/etc/lamalibre/lamaste/tickets.json` | JSON | lamaste:lamaste | 0600 | Ticket and session store |
27
+ | `/etc/lamalibre/lamaste/invitations.json` | JSON | lamaste:lamaste | 0600 | Pending user invitations |
28
+ | `/etc/lamalibre/lamaste/plugins.json` | JSON | lamaste:lamaste | 0600 | Plugin registry (before 4.2; the registry is now in `state.db`) |
29
+ | `/etc/lamalibre/lamaste/state.db` | SQLite | lamaste:lamaste | 0600 | Plugins (with their hooks), agents, tickets, enrollment tokens, the audit log, notifications, relay hook approvals, plugin operations, agent jobs |
30
+ | `/etc/lamalibre/lamaste/plugin-hostings.json` | JSON | lamaste:lamaste | 0600 | Hostings of agent-hosted plugins: agent, port, phase, installation secrets, health |
31
+ | `/opt/lamalibre/lamaste/hooks/<route>/` | directory | root:root | 0755 | A plugin's approved relay hook module (`<sha256>.mjs`, 0644) and `runner.env`, written by `lamaste-priv` |
32
+ | `/etc/lamalibre/lamaste/storage-config.json` | JSON | lamaste:lamaste | 0600 | Storage server registry and plugin bindings (credentials AES-256-GCM encrypted) |
33
+ | `/etc/lamalibre/lamaste/storage-master.key` | Binary | lamaste:lamaste | 0600 | 32-byte master key for storage credential encryption |
34
+ | `/etc/lamalibre/lamaste/groups.json` | JSON | lamaste:lamaste | 0600 | Lamaste group definitions and membership |
35
+ | `/etc/lamalibre/lamaste/access-grants.json` | JSON | lamaste:lamaste | 0600 | Generic access grants (principal → resource) |
36
+ | `/etc/lamalibre/lamaste/gatekeeper.json` | JSON | lamaste:lamaste | 0600 | Gatekeeper settings (cache TTL, admin contact, logging) |
37
+ | `/etc/lamalibre/lamaste/access-request-log.json` | JSON | lamaste:lamaste | 0600 | Optional denied access log |
38
+ | `/etc/lamalibre/lamaste/pki/enrollment-tokens.json` | JSON | lamaste:lamaste | 0600 | One-time enrollment tokens for hardware-bound enrollment |
39
+ | `/etc/lamalibre/lamaste/pki/revoked.json` | JSON | lamaste:lamaste | 0600 | Revoked certificate serial numbers |
40
+ | `/etc/lamalibre/lamaste/pki/agents/registry.json` | JSON | lamaste:lamaste | 0600 | Agent certificate metadata |
41
+ | `/etc/nginx/sites-available/lamalibre-lamaste-*` | nginx conf | root:root | 0644 | Vhost configurations (the panel's are installed by `lamaste-priv`) |
42
+ | `/etc/nginx/snippets/lamalibre-lamaste-mtls.conf` | nginx conf | root:root | 0644 | mTLS snippet |
43
+ | `/etc/nginx/snippets/lamalibre-lamaste-authz-cache.conf` | nginx conf | root:root | 0644 | Gatekeeper proxy_cache zone |
44
+ | `/etc/systemd/system/lamalibre-lamaste-gatekeeper.service` | systemd | root:root | 0644 | Gatekeeper systemd unit |
45
+ | `/etc/systemd/system/chisel.service` | systemd | root:root | 0644 | Chisel unit, written by `create-lamaste` |
46
+ | `/etc/systemd/system/authelia.service` | systemd | root:root | 0644 | Authelia unit, written by `create-lamaste` |
47
+ | `/etc/systemd/system/lamalibre-lamaste-hooks@.socket`, `@.service` | systemd | root:root | 0644 | Relay hook runner (one instance per plugin with relay hooks), written by `create-lamaste` |
48
+ | `~/.lamalibre/lamaste/servers.json` | JSON | user | 0600 | Desktop app server registry |
49
+ | `~/.lamalibre/lamaste/agents.json` | JSON | user | 0600 | Multi-agent registry |
50
+ | `~/.lamalibre/lamaste/agentd.token` | JSON | user | 0600 | Bearer token of lamaste-agentd's owner (the desktop app, scripts run as the user) |
51
+ | `~/.lamalibre/lamaste/agents/<label>/config.json` | JSON | user | 0600 | Per-agent configuration |
52
+ | `~/.lamalibre/lamaste/agents/<label>/client.p12` | PKCS#12 | user | 0600 | Per-agent mTLS certificate |
53
+ | `~/.lamalibre/lamaste/agents/<label>/ca.crt` | PEM | user | 0644 | Per-agent CA certificate |
54
+ | `~/.lamalibre/lamaste/agents/<label>/chisel.json` | JSON | user | 0600 | Per-agent Chisel credential (source of truth for the service) |
55
+ | `~/.lamalibre/lamaste/agents/<label>/chisel.env` | env file | user | 0600 | Linux only: `AUTH=` for the systemd unit's `EnvironmentFile=` |
56
+ | `~/.lamalibre/lamaste/agents/<label>/` | directory | user | 0700 | Per-agent data directory |
57
+ | `~/.lamalibre/lamaste/agents/<label>/sync-state.json` | JSON | user | 0600 | Outcome of the last `lamaste-agent sync` |
58
+ | `~/.lamalibre/lamaste/agents/<label>/app-plugins/<route>.json` | JSON | user | 0600 | Port and installation secret of a plugin hosted on this agent |
59
+ | `~/.lamalibre/lamaste/agents/<label>/app-plugin-tunnel-state.json` | JSON | user | 0600 | The tunnel state last delivered to each hosted plugin's agent half |
60
+ | `~/.lamalibre/lamaste/agents/<label>/apphost-state.json` | JSON | user | 0600 | The agent halves the app host helper installed for this agent |
61
+ | `~/.lamalibre/lamaste/agents/<label>/host-facts.json` | JSON | user | 0600 | What the agent last reported about its host, and the helper's last answer |
62
+ | `~/.lamalibre/lamaste/agents/<label>/app-job-results.json` | JSON | user | 0600 | App job results the relay has not taken yet |
63
+ | `~/.lamalibre/lamaste/agents/<label>/logs/` | directory | user | 0700 | Per-agent Chisel and sync log files |
64
+ | `~/.lamalibre/lamaste/agent.json` | JSON | user | 0600 | Legacy single-server config |
65
+ | `/usr/local/sbin/lamaste-apphost` | Node.js | root:root | 0755 | Agent machine: the app host helper — see [Agent machine: the app host](#agent-machine-the-app-host) |
66
+ | `/etc/sudoers.d/lamaste-apphost` | sudoers | root:root | 0440 | Agent machine: lets the agent's user run the helper |
67
+ | `/etc/lamalibre/apphost/relays/<label>.json` | JSON | root:root | 0644 | Agent machine: the relay key pinned for agent `<label>` |
68
+ | `/opt/lamalibre/apps/<route>/` | directory | root:root | 0755 | Agent machine: an agent half's installed versions |
69
+ | `/var/lib/lamalibre/apps/<route>/` | directory | lamaste-app-\<route\> | 0700 | Agent machine: an agent half's data |
70
+ | `/etc/lamalibre/apps/<route>/plugin-config.json` | JSON | lamaste-app-\<route\> | 0600 | Agent machine: an agent half's port and installation secret |
71
+ | `/etc/systemd/system/lamalibre-app-<route>.service` | systemd | root:root | 0644 | Agent machine: an agent half's unit |
52
72
 
53
73
  ---
54
74
 
@@ -756,6 +776,26 @@ A secret is minted when the client first appears (plugin install, or the registr
756
776
 
757
777
  ---
758
778
 
779
+ ## `/etc/lamalibre/lamaste/relay-signing-key.json`
780
+
781
+ The Ed25519 key the relay signs relay assertions with — the `X-Lamalibre-Relay-Assertion` header lamaste-agentd requires on every request from the relay (agent-panel vhost and plugin tunnels; see [Security Model](../01-concepts/security-model.md#5c-the-agent-daemon-lamaste-agentd-and-relay-assertions)).
782
+
783
+ ```json
784
+ {
785
+ "v": 1,
786
+ "privateKey": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n",
787
+ "createdAt": "2026-10-15T10:00:00.000Z"
788
+ }
789
+ ```
790
+
791
+ The panel creates it at startup when it is missing (exclusively: a 0600 temp file linked into place), logs its id (`Relay assertion signing key ready`, `kid`) and signs agent-panel requests with it — and every app job it creates for an agent's root helper ([App Host](../04-api-reference/app-host.md#signed-app-jobs)); Gatekeeper reads it and signs for plugin tunnels. Both re-read it when it changes — content or permissions — and refuse to sign with a key other users can read. Agents receive only the public key (`GET /api/agents/me/relay-keys`); its id is derived from the key. While it is unusable no app job is created.
792
+
793
+ **Rotation:** replace the file (or remove it and restart `lamalibre-lamaste-serverd`, which creates a new one). Agents fetch the new public key when the first assertion signed with it arrives, at most every 30 seconds — requests through the relay may be refused for up to that long after a rotation. The app host helpers do not: they keep the key their operator pinned, refuse the relay's app jobs until `sudo lamaste-agent apphost pin` runs on each agent machine, and the panel shows those agents as not eligible to host an agent half meanwhile.
794
+
795
+ **Mode:** 0600, owner `lamaste`.
796
+
797
+ ---
798
+
759
799
  ## Client-Side Configuration
760
800
 
761
801
  ### `~/.lamalibre/lamaste/servers.json`
@@ -868,21 +908,32 @@ The directory itself is mode 0700 (re-applied on every sync).
868
908
  - `logs/sync.log` — sync timer log: only runs that changed something, and each error when it first appears and when it clears
869
909
  - `plugins.json` — agent plugin registry
870
910
  - `plugins/` — per-plugin data directories
911
+ - `app-plugins/<route>.json` — the port and installation secret of a plugin hosted on this agent (mode 0600): `{ plugin, port, secret, issuedAt, previousSecret?, previousIssuedAt?, fetchedAt, acknowledged }`
912
+ - `apphost-state.json` — the agent halves the app host helper installed for this agent (mode 0600): `{ "apps": { "<route>": { "version": "1.0.0", "updatedAt": "…" } } }`. Written by the sync's app jobs; read by converge, which hands a fetched plugin config to the service of a route listed here before acknowledging it. When it cannot be read the sync rebuilds it from the helper's owner records naming this label
913
+ - `host-facts.json` — what was last reported as host facts and the helper's last answer (mode 0600): `{ "reported": { "hash", "at" } | null, "apphost": { "helper": "<dev:ino:size:mtime>", "facts": { "version", "node" } | null, "at" } | null }`. Facts are reported when their hash changes or a day passed; the helper is asked again when its file changes or a day passed
914
+ - `app-job-results.json` — results of app jobs the relay has not taken yet (mode 0600): `{ "<jobId>": { "result", "deadlineAt" } }` — a signed job runs once, so a report that failed is made again from here, until the job's deadline
915
+
916
+ An install job packs the agent package in `~/.lamalibre/lamaste/tmp/agent/apphost-*/` (0700, with a throw-away npm userconfig holding the brokered registry token) and deletes it afterwards.
871
917
 
872
918
  Service files use per-agent names:
873
919
 
874
920
  - macOS: `com.lamalibre.lamaste.chisel-<label>` (plist label), `~/Library/LaunchAgents/com.lamalibre.lamaste.chisel-<label>.plist` — mode 0600, because it carries `AUTH` in `EnvironmentVariables`
875
921
  - Linux: `lamalibre-lamaste-chisel-<label>` (unit name), `~/.config/systemd/user/lamalibre-lamaste-chisel-<label>.service` — a systemd **user** unit with `EnvironmentFile=` pointing at `chisel.env`; enable lingering (`sudo loginctl enable-linger <user>`) for it to start at boot without a login
876
922
 
877
- Both run `chisel client --max-retry-interval 30s https://tunnel.<domain>:443 R:127.0.0.1:<port>:127.0.0.1:<port> ...` with TLS verification and no credential in argv. They are generated by `@lamalibre/lamaste@4.2.0/agent` (`chisel-service.ts`) and rewritten by `lamaste-agent setup`, `update` and `sync` — do not edit them by hand. An agent carrying no tunnels has its service unloaded (Chisel cannot run without a remote).
923
+ Both run `chisel client --max-retry-interval 30s https://tunnel.<domain>:443 R:127.0.0.1:<port>:127.0.0.1:<port> ...` with TLS verification and no credential in argv. They are generated by `@lamalibre/lamaste@4.3.0/agent` (`chisel-service.ts`) and rewritten by `lamaste-agent setup`, `update` and `sync` — do not edit them by hand. An agent carrying no tunnels has its service unloaded (Chisel cannot run without a remote).
878
924
 
879
925
  The sync timer, which runs `<node> <installed lamaste-agent> sync --label <label> --quiet` (`<node>` is a stable path such as `/opt/homebrew/bin/node` when one on `PATH` resolves to the running binary, so a Node.js upgrade does not break it):
880
926
 
881
927
  - macOS: `com.lamalibre.lamaste.sync-<label>` (plist label), `~/Library/LaunchAgents/com.lamalibre.lamaste.sync-<label>.plist` — `StartInterval` 30, `RunAtLoad`
882
- - Linux: `~/.config/systemd/user/lamalibre-lamaste-sync-<label>.service` (`Type=oneshot`) and `lamalibre-lamaste-sync-<label>.timer` (`OnActiveSec=5s`, `OnUnitInactiveSec=30s`) — also needs lingering to run without a login
928
+ - Linux: `~/.config/systemd/user/lamalibre-lamaste-sync-<label>.service` (`Type=oneshot`, `TimeoutStartSec=20min` — converge and the relay's jobs, the longest of which installs an agent half in up to 10 minutes) and `lamalibre-lamaste-sync-<label>.timer` (`OnActiveSec=5s`, `OnUnitInactiveSec=30s`) — also needs lingering to run without a login
883
929
 
884
930
  Both contain no secret (mode 0644) and are removed by `lamaste-agent uninstall` and by the desktop app's uninstall.
885
931
 
932
+ The agent panel daemon (`lamaste-agentd`, started by `lamaste-agent panel --enable`):
933
+
934
+ - macOS: `com.lamalibre.lamaste.panel-<label>` (plist label), `~/Library/LaunchAgents/com.lamalibre.lamaste.panel-<label>.plist` — `RunAtLoad`, `KeepAlive`
935
+ - Linux: `~/.config/systemd/user/lamalibre-lamaste-panel-<label>.service`, enabled into `default.target` — needs lingering to run without a login. Units written before 4.3 named `multi-user.target`, which a user manager does not have, so the panel never started at boot; `lamaste-agent update` and `lamaste-agent panel --enable` rewrite that line and re-enable an enabled unit
936
+
886
937
  ---
887
938
 
888
939
  ### `~/.lamalibre/lamaste/agent.json`
@@ -891,6 +942,33 @@ Legacy single-server configuration. Automatically migrated to the multi-agent re
891
942
 
892
943
  ---
893
944
 
945
+ ## Agent machine: the app host
946
+
947
+ On a Linux agent where the operator ran `sudo lamaste-agent apphost enable`, the root helper `lamaste-apphost` installs the agent halves of the plugins the panel hosts there ([App Host](../04-api-reference/app-host.md)). Every path below is derived from a validated route or agent label; root writes them atomically (temp file, `fsync`, rename) and refuses to use one that is not what it expects — a directory another user can write, a link where a file belongs.
948
+
949
+ | Path | Owner | Mode | Contents |
950
+ | --------------------------------------------------- | ---------------------------- | --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
951
+ | `/usr/local/sbin/lamaste-apphost` | root:root | 0755 | The helper — copied by `enable` from a root-owned `lamaste-agent` install |
952
+ | `/etc/sudoers.d/lamaste-apphost` | root:root | 0440 | `<user> ALL=(root) NOPASSWD: /usr/local/sbin/lamaste-apphost`, with `env_reset`, `!setenv` and Node.js variables deleted; checked with `visudo -c` before it is renamed into place. None when the agent runs as root |
953
+ | `/etc/lamalibre/apphost/relays/<label>.json` | root:root | 0644 (dirs 0755) | The relay key pinned for agent `<label>`: `{ v, label, agent, kid, publicKey, panelUrl, pinnedAt }` — public material |
954
+ | `/opt/lamalibre/apps/<route>/<version>/` | root:root | dirs 0755, files 0644 | The package as published (`package/`) and `apphost.json`, the spec it was installed with |
955
+ | `/opt/lamalibre/apps/<route>/current`, `previous` | root:root | symlinks | The running version and the one before it; other versions are deleted |
956
+ | `/opt/lamalibre/apps/.stage-<hex>-<route>/` | root:root | 0700 | Unpacking while an install runs |
957
+ | `/var/lib/lamalibre/apps/<route>/` | the agent half's account | 0700 | The agent half's data (`LAMASTE_APP_DATA_DIR`) — kept on removal, deleted by a purge |
958
+ | `/var/lib/lamalibre/apps/.owners/<route>.json` | root:root | 0644 (dir 0755) | Who owns the route on this machine: `{ route, package, label, since }` — kept on removal, deleted by a purge |
959
+ | `/var/lib/lamalibre/apps/.jobs/used.json` | root:root | 0600 (dir 0700) | `{ v: 1, jobs: { <jobId>: <expiry, ms> } }` — the signed jobs that ran, each until it expires |
960
+ | `/var/lib/lamalibre/apps/.trash/` | root:root | 0700 | Purged data, deleted there |
961
+ | `/etc/lamalibre/apps/<route>/` | root:\<the account's group\> | 0750 | The agent half's configuration directory |
962
+ | `/etc/lamalibre/apps/<route>/plugin-config.json` | the agent half's account | 0600 | Port and installation secret (`LAMASTE_APP_CONFIG`), the shape of the agent's `app-plugins/<route>.json` |
963
+ | `/etc/systemd/system/lamalibre-app-<route>.service` | root:root | 0644 | The agent half's unit, from a fixed template — paths, never secrets |
964
+ | `/run/lamaste-apphost.lock` | root:root | 0600 | Held (with the owner's PID) while a mutating helper command runs |
965
+
966
+ The agent half's account and group are `lamaste-app-<route>` for routes of up to 18 characters, `lamaste-app-<first 2 characters>-<16 hex digits of SHA-256(route)>` otherwise; the account's comment is `lamaste-app route=<route>`. `/opt/lamalibre`, `/opt/lamalibre/apps`, `/var/lib/lamalibre`, `/var/lib/lamalibre/apps`, `/etc/lamalibre` and `/etc/lamalibre/apps` are root-owned 0755.
967
+
968
+ `sudo lamaste-agent apphost disable` removes the rule, the helper and the pins (and `/etc/lamalibre/apphost` when it is empty). Removing an agent half deletes its unit, code and configuration directory; a purge also deletes its data directory, account and owner record. System packages are never removed.
969
+
970
+ ---
971
+
894
972
  ## nginx Vhost Patterns
895
973
 
896
974
  ### `/etc/nginx/sites-available/lamalibre-lamaste-panel-ip`
@@ -1067,56 +1145,71 @@ WantedBy=multi-user.target
1067
1145
 
1068
1146
  ## File Permissions Table
1069
1147
 
1070
- | Path | Owner | Mode | Notes |
1071
- | ---------------------------------------------------------------------- | --------------------------------- | ---- | --------------------------------------------------------- |
1072
- | `/etc/lamalibre/lamaste/` | lamaste:lamaste | 0755 | State directory |
1073
- | `/etc/lamalibre/lamaste/panel.json` | lamaste:lamaste | 0600 | Panel config |
1074
- | `/etc/lamalibre/lamaste/tunnels.json` | lamaste:lamaste | 0600 | Tunnel state |
1075
- | `/etc/lamalibre/lamaste/sites.json` | lamaste:lamaste | 0600 | Site state |
1076
- | `/etc/lamalibre/lamaste/chisel-credentials.json` | lamaste:lamaste | 0600 | Chisel credentials |
1077
- | `/etc/lamalibre/lamaste/chisel-users` | lamaste:lamaste-chisel | 0640 | Chisel authfile |
1078
- | `/etc/lamalibre/lamaste/chisel-sentinel` | lamaste:lamaste | 0600 | Sentinel password |
1079
- | `/etc/lamalibre/lamaste/pki/` | lamaste:lamaste | 0700 | PKI directory |
1080
- | `/etc/lamalibre/lamaste/pki/ca.key` | lamaste:lamaste | 0600 | CA private key |
1081
- | `/etc/lamalibre/lamaste/pki/ca.crt` | lamaste:lamaste | 0644 | CA certificate |
1082
- | `/etc/lamalibre/lamaste/pki/client.key` | lamaste:lamaste | 0600 | Client private key |
1083
- | `/etc/lamalibre/lamaste/pki/client.crt` | lamaste:lamaste | 0644 | Client certificate |
1084
- | `/etc/lamalibre/lamaste/pki/client.p12` | lamaste:lamaste | 0600 | PKCS12 bundle |
1085
- | `/etc/lamalibre/lamaste/pki/.p12-password` | lamaste:lamaste | 0600 | PKCS12 password |
1086
- | `/etc/lamalibre/lamaste/pki/self-signed.pem` | lamaste:lamaste | 0644 | Self-signed TLS cert |
1087
- | `/etc/lamalibre/lamaste/pki/self-signed-key.pem` | lamaste:lamaste | 0600 | Self-signed TLS key |
1088
- | `/etc/lamalibre/lamaste/ticket-scopes.json` | lamaste:lamaste | 0600 | Ticket scope registry |
1089
- | `/etc/lamalibre/lamaste/tickets.json` | lamaste:lamaste | 0600 | Ticket/session store |
1090
- | `/etc/lamalibre/lamaste/invitations.json` | lamaste:lamaste | 0600 | Pending invitations |
1091
- | `/etc/lamalibre/lamaste/plugins.json` | lamaste:lamaste | 0600 | Plugin registry |
1092
- | `/etc/lamalibre/lamaste/storage-config.json` | lamaste:lamaste | 0600 | Storage registry |
1093
- | `/etc/lamalibre/lamaste/storage-master.key` | lamaste:lamaste | 0600 | Storage encryption key |
1094
- | `/etc/lamalibre/lamaste/groups.json` | lamaste:lamaste | 0600 | Lamaste groups |
1095
- | `/etc/lamalibre/lamaste/access-grants.json` | lamaste:lamaste | 0600 | Access grants |
1096
- | `/etc/lamalibre/lamaste/gatekeeper.json` | lamaste:lamaste | 0600 | Gatekeeper settings |
1097
- | `/etc/lamalibre/lamaste/access-request-log.json` | lamaste:lamaste | 0600 | Denied access log |
1098
- | `/etc/lamalibre/lamaste/pki/enrollment-tokens.json` | lamaste:lamaste | 0600 | Enrollment tokens |
1099
- | `/etc/lamalibre/lamaste/pki/revoked.json` | lamaste:lamaste | 0600 | Revocation list |
1100
- | `/etc/lamalibre/lamaste/pki/agents/registry.json` | lamaste:lamaste | 0600 | Agent cert metadata |
1101
- | `/etc/lamalibre/lamaste/chisel-server.key` | lamaste:lamaste-chisel | 0640 | Chisel SSH host key |
1102
- | `/etc/authelia/` | lamaste:lamaste-authelia | 2770 | Authelia config (setgid) |
1103
- | `/etc/authelia/configuration.yml` | lamaste:lamaste-authelia | 0640 | Auth config |
1104
- | `/etc/authelia/users.yml` | lamaste:lamaste-authelia | 0660 | User database |
1105
- | `/etc/authelia/.secrets.json` | lamaste:lamaste-authelia | 0600 | Auth secrets (panel only) |
1106
- | `/etc/authelia/db.sqlite3`, `notifications.txt` | lamaste-authelia:lamaste-authelia | 0600 | Authelia's own files |
1107
- | `/var/log/authelia/` | lamaste-authelia:lamaste-authelia | 0750 | Authelia log |
1108
- | `/opt/lamalibre/lamaste/` | root:root | 0755 | Install directory (read-only for lamaste) |
1109
- | `/var/www/lamaste/` | lamaste:www-data | 2750 | Static site files (files 0640; nginx reads via the group) |
1110
- | `/etc/sudoers.d/lamaste` | root:root | 0440 | Sudo rules (no wildcards) |
1111
- | `/usr/local/sbin/lamaste-priv`, `lamaste-certbot`, `lamaste-cert-info` | root:root | 0755 | Validating sudo programs |
1112
- | `/usr/local/bin/chisel`, `/usr/local/bin/authelia` | root:root | 0755 | Pinned releases (`create-lamaste`) |
1113
- | `~/.lamalibre/lamaste/servers.json` | user | 0600 | Server registry |
1114
- | `~/.lamalibre/lamaste/agent.json` | user | 0600 | Legacy agent config |
1115
- | `~/.lamalibre/lamaste/agents/<label>/` | user | 0700 | Agent data directory |
1116
- | `~/.lamalibre/lamaste/agents/<label>/chisel.json` | user | 0600 | Agent Chisel credential |
1117
- | `~/.lamalibre/lamaste/agents/<label>/chisel.env` | user | 0600 | Linux `AUTH=` env file |
1118
- | `~/Library/LaunchAgents/com.lamalibre.lamaste.chisel-<label>.plist` | user | 0600 | macOS service (has `AUTH`) |
1119
- | `~/.lamalibre/lamaste/services.json` | user | 0600 | Service registry |
1148
+ | Path | Owner | Mode | Notes |
1149
+ | --------------------------------------------------------------------------------------------------- | --------------------------------- | ---- | --------------------------------------------------------- |
1150
+ | `/etc/lamalibre/lamaste/` | lamaste:lamaste | 0755 | State directory |
1151
+ | `/etc/lamalibre/lamaste/panel.json` | lamaste:lamaste | 0600 | Panel config |
1152
+ | `/etc/lamalibre/lamaste/tunnels.json` | lamaste:lamaste | 0600 | Tunnel state |
1153
+ | `/etc/lamalibre/lamaste/sites.json` | lamaste:lamaste | 0600 | Site state |
1154
+ | `/etc/lamalibre/lamaste/chisel-credentials.json` | lamaste:lamaste | 0600 | Chisel credentials |
1155
+ | `/etc/lamalibre/lamaste/chisel-users` | lamaste:lamaste-chisel | 0640 | Chisel authfile |
1156
+ | `/etc/lamalibre/lamaste/chisel-sentinel` | lamaste:lamaste | 0600 | Sentinel password |
1157
+ | `/etc/lamalibre/lamaste/relay-signing-key.json` | lamaste:lamaste | 0600 | Relay assertion signing key |
1158
+ | `/etc/lamalibre/lamaste/pki/` | lamaste:lamaste | 0700 | PKI directory |
1159
+ | `/etc/lamalibre/lamaste/pki/ca.key` | lamaste:lamaste | 0600 | CA private key |
1160
+ | `/etc/lamalibre/lamaste/pki/ca.crt` | lamaste:lamaste | 0644 | CA certificate |
1161
+ | `/etc/lamalibre/lamaste/pki/client.key` | lamaste:lamaste | 0600 | Client private key |
1162
+ | `/etc/lamalibre/lamaste/pki/client.crt` | lamaste:lamaste | 0644 | Client certificate |
1163
+ | `/etc/lamalibre/lamaste/pki/client.p12` | lamaste:lamaste | 0600 | PKCS12 bundle |
1164
+ | `/etc/lamalibre/lamaste/pki/.p12-password` | lamaste:lamaste | 0600 | PKCS12 password |
1165
+ | `/etc/lamalibre/lamaste/pki/self-signed.pem` | lamaste:lamaste | 0644 | Self-signed TLS cert |
1166
+ | `/etc/lamalibre/lamaste/pki/self-signed-key.pem` | lamaste:lamaste | 0600 | Self-signed TLS key |
1167
+ | `/etc/lamalibre/lamaste/ticket-scopes.json` | lamaste:lamaste | 0600 | Ticket scope registry |
1168
+ | `/etc/lamalibre/lamaste/tickets.json` | lamaste:lamaste | 0600 | Ticket/session store |
1169
+ | `/etc/lamalibre/lamaste/invitations.json` | lamaste:lamaste | 0600 | Pending invitations |
1170
+ | `/etc/lamalibre/lamaste/plugins.json` | lamaste:lamaste | 0600 | Plugin registry |
1171
+ | `/etc/lamalibre/lamaste/storage-config.json` | lamaste:lamaste | 0600 | Storage registry |
1172
+ | `/etc/lamalibre/lamaste/storage-master.key` | lamaste:lamaste | 0600 | Storage encryption key |
1173
+ | `/etc/lamalibre/lamaste/groups.json` | lamaste:lamaste | 0600 | Lamaste groups |
1174
+ | `/etc/lamalibre/lamaste/access-grants.json` | lamaste:lamaste | 0600 | Access grants |
1175
+ | `/etc/lamalibre/lamaste/gatekeeper.json` | lamaste:lamaste | 0600 | Gatekeeper settings |
1176
+ | `/etc/lamalibre/lamaste/access-request-log.json` | lamaste:lamaste | 0600 | Denied access log |
1177
+ | `/etc/lamalibre/lamaste/pki/enrollment-tokens.json` | lamaste:lamaste | 0600 | Enrollment tokens |
1178
+ | `/etc/lamalibre/lamaste/pki/revoked.json` | lamaste:lamaste | 0600 | Revocation list |
1179
+ | `/etc/lamalibre/lamaste/pki/agents/registry.json` | lamaste:lamaste | 0600 | Agent cert metadata |
1180
+ | `/etc/lamalibre/lamaste/chisel-server.key` | lamaste:lamaste-chisel | 0640 | Chisel SSH host key |
1181
+ | `/etc/authelia/` | lamaste:lamaste-authelia | 2770 | Authelia config (setgid) |
1182
+ | `/etc/authelia/configuration.yml` | lamaste:lamaste-authelia | 0640 | Auth config |
1183
+ | `/etc/authelia/users.yml` | lamaste:lamaste-authelia | 0660 | User database |
1184
+ | `/etc/authelia/.secrets.json` | lamaste:lamaste-authelia | 0600 | Auth secrets (panel only) |
1185
+ | `/etc/authelia/db.sqlite3`, `notifications.txt` | lamaste-authelia:lamaste-authelia | 0600 | Authelia's own files |
1186
+ | `/var/log/authelia/` | lamaste-authelia:lamaste-authelia | 0750 | Authelia log |
1187
+ | `/opt/lamalibre/lamaste/` | root:root | 0755 | Install directory (read-only for lamaste) |
1188
+ | `/opt/lamalibre/lamaste/hooks/<route>/<sha256>.mjs` | root:root | 0644 | Approved relay hook module (read by the sandboxed runner) |
1189
+ | `/run/lamalibre-lamaste-hooks/<route>.sock` | root:lamaste | 0660 | Relay hook runner socket (systemd) |
1190
+ | `/var/www/lamaste/` | lamaste:www-data | 2750 | Static site files (files 0640; nginx reads via the group) |
1191
+ | `/etc/sudoers.d/lamaste` | root:root | 0440 | Sudo rules (no wildcards) |
1192
+ | `/usr/local/sbin/lamaste-priv`, `lamaste-certbot`, `lamaste-cert-info` | root:root | 0755 | Validating sudo programs |
1193
+ | `/usr/local/bin/chisel`, `/usr/local/bin/authelia` | root:root | 0755 | Pinned releases (`create-lamaste`) |
1194
+ | `~/.lamalibre/lamaste/servers.json` | user | 0600 | Server registry |
1195
+ | `~/.lamalibre/lamaste/agent.json` | user | 0600 | Legacy agent config |
1196
+ | `~/.lamalibre/lamaste/agentd.token` | user | 0600 | Agent daemon owner token |
1197
+ | `~/.lamalibre/lamaste/agents/<label>/` | user | 0700 | Agent data directory |
1198
+ | `~/.lamalibre/lamaste/agents/<label>/chisel.json` | user | 0600 | Agent Chisel credential |
1199
+ | `~/.lamalibre/lamaste/agents/<label>/chisel.env` | user | 0600 | Linux `AUTH=` env file |
1200
+ | `~/Library/LaunchAgents/com.lamalibre.lamaste.chisel-<label>.plist` | user | 0600 | macOS service (has `AUTH`) |
1201
+ | `~/.lamalibre/lamaste/services.json` | user | 0600 | Service registry |
1202
+ | `~/.lamalibre/lamaste/agents/<label>/apphost-state.json`, `host-facts.json`, `app-job-results.json` | user | 0600 | App host record, host facts, unreported app job results |
1203
+ | `/usr/local/sbin/lamaste-apphost` | root:root | 0755 | App host helper (agent machine) |
1204
+ | `/etc/sudoers.d/lamaste-apphost` | root:root | 0440 | App host rule (agent machine) |
1205
+ | `/etc/lamalibre/apphost/relays/<label>.json` | root:root | 0644 | Pinned relay key (agent machine) |
1206
+ | `/opt/lamalibre/apps/<route>/` | root:root | 0755 | Agent half code, files 0644 (agent machine) |
1207
+ | `/var/lib/lamalibre/apps/<route>/` | lamaste-app-\<route\> | 0700 | Agent half data (agent machine) |
1208
+ | `/var/lib/lamalibre/apps/.owners/<route>.json` | root:root | 0644 | Owner record (agent machine) |
1209
+ | `/var/lib/lamalibre/apps/.jobs/`, `.trash/` | root:root | 0700 | Signed jobs run; purged data (agent machine) |
1210
+ | `/etc/lamalibre/apps/<route>/` | root:lamaste-app-\<route\> | 0750 | Agent half config directory (agent machine) |
1211
+ | `/etc/lamalibre/apps/<route>/plugin-config.json` | lamaste-app-\<route\> | 0600 | Agent half port and secret (agent machine) |
1212
+ | `/etc/systemd/system/lamalibre-app-<route>.service` | root:root | 0644 | Agent half unit (agent machine) |
1120
1213
 
1121
1214
  ## Quick Reference
1122
1215
 
package/vendor/docs/06-reference/glossary.md CHANGED
@@ -24,7 +24,7 @@ If you are reading documentation and hit an unfamiliar term, this is the place t
24
24
 
25
25
  **Where it appears:**
26
26
 
27
- - Enrolled from the panel (**Certificates → Enrollment Token**) and `lamaste-agent setup` (installed globally with `npm install -g @lamalibre/lamaste-agent@4.2.0`)
27
+ - Enrolled from the panel (**Certificates → Enrollment Token**) and `lamaste-agent setup` (installed globally with `npm install -g @lamalibre/lamaste-agent@4.3.0`)
28
28
  - Agent registry: `/etc/lamalibre/lamaste/agents.json` on the server; `~/.lamalibre/lamaste/agents/<label>/` on the agent
29
29
  - The **Agent** column and field on the panel's Tunnels page
30
30
 
@@ -242,7 +242,7 @@ See also: [mTLS](#mtls-mutual-tls), [CA](#ca-certificate-authority), [PKCS12](#p
242
242
 
243
243
  **Where it appears:**
244
244
 
245
- - Generated by `lamaste-agent setup` / `update` (implementation in `@lamalibre/lamaste@4.2.0/agent`)
245
+ - Generated by `lamaste-agent setup` / `update` (implementation in `@lamalibre/lamaste@4.3.0/agent`)
246
246
  - Installed to `~/Library/LaunchAgents/com.lamalibre.lamaste.chisel-<label>.plist` on the agent
247
247
  - Manages the Chisel client process lifecycle
248
248
 
@@ -373,7 +373,7 @@ See also: [Client Certificate](#client-certificate), [CA](#ca-certificate-author
373
373
 
374
374
  **Plain English:** A small scheduled job on every agent that checks with the panel every 30 seconds and adjusts the tunnel client when the agent's tunnels changed — so tunnels created, disabled or moved in the panel reach the agent without anyone running a command on it.
375
375
 
376
- **Technical:** Runs `lamaste-agent sync --label <label>`, which fetches `GET /api/tunnels/agent-config` and converges the agent's Chisel client with it (relay URL, credential, pinned binary, granted remotes, running or stopped). It exists because Chisel rejects a client's whole session when one requested remote is not granted: an agent must drop a revoked tunnel promptly or all its other tunnels go dark. Requires a global install of `@lamalibre/lamaste-agent@4.2.0`.
376
+ **Technical:** Runs `lamaste-agent sync --label <label>`, which fetches `GET /api/tunnels/agent-config` and converges the agent's Chisel client with it (relay URL, credential, pinned binary, granted remotes, running or stopped). It exists because Chisel rejects a client's whole session when one requested remote is not granted: an agent must drop a revoked tunnel promptly or all its other tunnels go dark. Requires a global install of `@lamalibre/lamaste-agent@4.3.0`.
377
377
 
378
378
  **Where it appears:**
379
379
 
package/vendor/docs/06-reference/installer-flags.md CHANGED
@@ -1,11 +1,11 @@
1
1
  # Installer Flags
2
2
 
3
- > CLI flags, environment variables, and exit codes for `npx @lamalibre/create-lamaste@4.2.0`.
3
+ > CLI flags, environment variables, and exit codes for `npx @lamalibre/create-lamaste@4.3.0`.
4
4
 
5
5
  ## Usage
6
6
 
7
7
  ```bash
8
- npx @lamalibre/create-lamaste@4.2.0 [flags]
8
+ npx @lamalibre/create-lamaste@4.3.0 [flags]
9
9
  ```
10
10
 
11
11
  The installer runs as root on a fresh Ubuntu 24.04 server. It is completely non-interactive by default — all configuration happens later through the browser-based onboarding wizard.
@@ -26,7 +26,7 @@ The installer runs as root on a fresh Ubuntu 24.04 server. It is completely non-
26
26
  Prints a description of what the installer does, lists all flags, and exits with code 0. Does not modify anything on the system.
27
27
 
28
28
  ```bash
29
- npx @lamalibre/create-lamaste@4.2.0 --help
29
+ npx @lamalibre/create-lamaste@4.3.0 --help
30
30
  ```
31
31
 
32
32
  ### `--yes`, `-y`
@@ -34,7 +34,7 @@ npx @lamalibre/create-lamaste@4.2.0 --help
34
34
  Skips the interactive confirmation prompt that appears before installation begins. Useful for automated deployments or scripts where you cannot press Enter.
35
35
 
36
36
  ```bash
37
- npx @lamalibre/create-lamaste@4.2.0 --yes
37
+ npx @lamalibre/create-lamaste@4.3.0 --yes
38
38
  ```
39
39
 
40
40
  Without this flag, the installer displays a banner listing all changes it will make and waits for the user to press Enter or Ctrl+C.
@@ -51,7 +51,7 @@ Skips all OS hardening tasks:
51
51
  Everything else (Node.js, nginx, mTLS, panel deployment) still runs.
52
52
 
53
53
  ```bash
54
- npx @lamalibre/create-lamaste@4.2.0 --skip-harden
54
+ npx @lamalibre/create-lamaste@4.3.0 --skip-harden
55
55
  ```
56
56
 
57
57
  Use this if you manage your own firewall rules, already have fail2ban configured, or are running on a platform that handles security at a different layer.
@@ -61,7 +61,7 @@ Use this if you manage your own firewall rules, already have fail2ban configured
61
61
  Allows the installer to run on a machine with a private or non-routable IP address (e.g., `192.168.x.x`, `10.x.x.x`). By default, the installer requires a public IP.
62
62
 
63
63
  ```bash
64
- npx @lamalibre/create-lamaste@4.2.0 --dev
64
+ npx @lamalibre/create-lamaste@4.3.0 --dev
65
65
  ```
66
66
 
67
67
  This is useful for:
@@ -76,7 +76,7 @@ When `--dev` is active, the installer prints the detected IP with a note: `(dev
76
76
  Forces the installer to run the complete installation pipeline, ignoring skip guards that would normally detect an existing installation. This is useful when an installation is in an inconsistent state and you want to ensure all components are fully deployed.
77
77
 
78
78
  ```bash
79
- npx @lamalibre/create-lamaste@4.2.0 --force-full
79
+ npx @lamalibre/create-lamaste@4.3.0 --force-full
80
80
  ```
81
81
 
82
82
  Use this if:
@@ -90,7 +90,7 @@ Use this if:
90
90
  Prints a step-by-step guide for manually removing Lamaste from the server, then exits with code 0. Does not modify anything on the system.
91
91
 
92
92
  ```bash
93
- npx @lamalibre/create-lamaste@4.2.0 --uninstall
93
+ npx @lamalibre/create-lamaste@4.3.0 --uninstall
94
94
  ```
95
95
 
96
96
  The printed guide first points to the automated removal, `sudo lamaste-server uninstall`, then covers:
@@ -207,25 +207,25 @@ Components that are always redeployed on re-run:
207
207
 
208
208
  ```bash
209
209
  ssh root@203.0.113.42
210
- npx @lamalibre/create-lamaste@4.2.0
210
+ npx @lamalibre/create-lamaste@4.3.0
211
211
  ```
212
212
 
213
213
  **Automated install (no confirmation prompt):**
214
214
 
215
215
  ```bash
216
- npx @lamalibre/create-lamaste@4.2.0 --yes
216
+ npx @lamalibre/create-lamaste@4.3.0 --yes
217
217
  ```
218
218
 
219
219
  **Install without OS hardening:**
220
220
 
221
221
  ```bash
222
- npx @lamalibre/create-lamaste@4.2.0 --yes --skip-harden
222
+ npx @lamalibre/create-lamaste@4.3.0 --yes --skip-harden
223
223
  ```
224
224
 
225
225
  **Test in a local VM:**
226
226
 
227
227
  ```bash
228
- npx @lamalibre/create-lamaste@4.2.0 --dev
228
+ npx @lamalibre/create-lamaste@4.3.0 --dev
229
229
  ```
230
230
 
231
231
  **Update an existing installation:**
@@ -237,7 +237,7 @@ npx @lamalibre/create-lamaste@latest --yes
237
237
  **View the uninstall guide:**
238
238
 
239
239
  ```bash
240
- npx @lamalibre/create-lamaste@4.2.0 --uninstall
240
+ npx @lamalibre/create-lamaste@4.3.0 --uninstall
241
241
  ```
242
242
 
243
243
  ## Quick Reference
package/vendor/docs/06-reference/ports-and-services.md CHANGED
@@ -34,7 +34,7 @@ A tunnel's port is also a loopback port on the relay: its vhost proxies to `127.
34
34
  | 9292 | IP-based panel listener |
35
35
  | 9294 | Gatekeeper |
36
36
 
37
- A tunnel on one of them would publish that internal service on a public hostname. For the panel that is an administrator takeover, not a leak: the panel trusts the client-certificate headers nginx sets. `RESERVED_TUNNEL_PORTS` in `@lamalibre/lamaste@4.2.0` is enforced by the request schema, inside the tunnel workflow, and again when the Chisel grants are rendered. Tunnel ports must also be 1024–65535.
37
+ A tunnel on one of them would publish that internal service on a public hostname. For the panel that is an administrator takeover, not a leak: the panel trusts the client-certificate headers nginx sets. `RESERVED_TUNNEL_PORTS` in `@lamalibre/lamaste@4.3.0` is enforced by the request schema, inside the tunnel workflow, and again when the Chisel grants are rendered. Tunnel ports must also be 1024–65535.
38
38
 
39
39
  ## Systemd Units
40
40