@lamalibre/create-lamaste 4.3.0 → 4.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (79) hide show
  1. package/package.json +2 -2
  2. package/scripts/bundle-vendor.js +13 -8
  3. package/src/index.js +4 -0
  4. package/src/lib/panel-pin.js +41 -0
  5. package/src/lib/service-config.js +6 -0
  6. package/vendor/docs/00-introduction/how-it-works.md +2 -2
  7. package/vendor/docs/00-introduction/quickstart.md +5 -5
  8. package/vendor/docs/00-introduction/what-is-lamaste.md +5 -5
  9. package/vendor/docs/01-concepts/certificates.md +3 -3
  10. package/vendor/docs/01-concepts/mtls.md +2 -2
  11. package/vendor/docs/01-concepts/security-model.md +50 -2
  12. package/vendor/docs/01-concepts/tickets.md +2 -2
  13. package/vendor/docs/01-concepts/tunneling.md +4 -4
  14. package/vendor/docs/02-guides/agent-setup.md +6 -6
  15. package/vendor/docs/02-guides/certificate-management.md +2 -2
  16. package/vendor/docs/02-guides/cloud-provisioning.md +4 -4
  17. package/vendor/docs/02-guides/desktop-app-setup.md +12 -11
  18. package/vendor/docs/02-guides/installation.md +3 -3
  19. package/vendor/docs/02-guides/onboarding.md +2 -2
  20. package/vendor/docs/02-guides/standalone-plugin-with-tickets.md +2 -2
  21. package/vendor/docs/03-architecture/installer-flow.md +2 -2
  22. package/vendor/docs/03-architecture/installer.md +4 -4
  23. package/vendor/docs/03-architecture/management-flow.md +1 -1
  24. package/vendor/docs/03-architecture/overview.md +5 -5
  25. package/vendor/docs/03-architecture/panel-client.md +7 -7
  26. package/vendor/docs/03-architecture/panel-server.md +2 -2
  27. package/vendor/docs/03-architecture/state-management.md +2 -2
  28. package/vendor/docs/03-architecture/system-overview.md +1 -1
  29. package/vendor/docs/04-api-reference/agent-hosted-plugins.md +393 -33
  30. package/vendor/docs/04-api-reference/app-host.md +87 -38
  31. package/vendor/docs/04-api-reference/audit-and-notifications.md +10 -10
  32. package/vendor/docs/04-api-reference/certificates.md +22 -19
  33. package/vendor/docs/04-api-reference/lifecycle-hooks.md +33 -11
  34. package/vendor/docs/04-api-reference/onboarding.md +1 -1
  35. package/vendor/docs/04-api-reference/overview.md +137 -135
  36. package/vendor/docs/04-api-reference/registry-and-oidc.md +1 -1
  37. package/vendor/docs/04-api-reference/tunnels.md +14 -10
  38. package/vendor/docs/05-operations/backup-and-restore.md +4 -1
  39. package/vendor/docs/05-operations/uninstalling.md +1 -1
  40. package/vendor/docs/05-operations/upgrades.md +6 -6
  41. package/vendor/docs/06-reference/config-files.md +94 -84
  42. package/vendor/docs/06-reference/glossary.md +3 -3
  43. package/vendor/docs/06-reference/installer-flags.md +13 -13
  44. package/vendor/docs/06-reference/ports-and-services.md +1 -1
  45. package/vendor/docs/06-reference/troubleshooting.md +8 -8
  46. package/vendor/docs/gatekeeper-design.md +8 -8
  47. package/vendor/docs/identity-directory-design.md +2 -2
  48. package/vendor/docs/package.json +1 -1
  49. package/vendor/docs/todo/lib-cli-desktop-refactor.md +27 -27
  50. package/vendor/gatekeeper/dist/cli/index.js +0 -0
  51. package/vendor/gatekeeper/package.json +2 -2
  52. package/vendor/server/bin/lamaste-server.js +11 -1
  53. package/vendor/server/package.json +4 -3
  54. package/vendor/server/src/commands/panel-pin.js +40 -0
  55. package/vendor/server/src/commands/plugin-settings.js +541 -0
  56. package/vendor/server/src/commands/plugins.js +94 -27
  57. package/vendor/server/src/panel-api.js +281 -34
  58. package/vendor/server/src/panel-identity.js +165 -0
  59. package/vendor/server/src/plugin-approval.js +78 -0
  60. package/vendor/server/src/plugin-settings.js +699 -0
  61. package/vendor/server-ui/dist/assets/index-25wo_8av.css +1 -0
  62. package/vendor/server-ui/dist/assets/index-CESyyK8V.js +84 -0
  63. package/vendor/server-ui/dist/index.html +2 -2
  64. package/vendor/serverd/package.json +2 -2
  65. package/vendor/serverd/src/index.js +9 -0
  66. package/vendor/serverd/src/lib/agent-presence.js +106 -0
  67. package/vendor/serverd/src/lib/hook-pipelines.js +20 -4
  68. package/vendor/serverd/src/lib/migrations/state/0012_plugin_settings_and_presence.sql +62 -0
  69. package/vendor/serverd/src/lib/mtls.js +44 -4
  70. package/vendor/serverd/src/lib/plugin-hooks.js +120 -20
  71. package/vendor/serverd/src/lib/plugin-hosting.js +35 -14
  72. package/vendor/serverd/src/lib/plugin-lifecycle.js +267 -83
  73. package/vendor/serverd/src/lib/plugin-settings.js +1101 -0
  74. package/vendor/serverd/src/lib/plugins.js +73 -22
  75. package/vendor/serverd/src/lib/tunnel-hooks.js +11 -0
  76. package/vendor/serverd/src/routes/management/plugins.js +166 -19
  77. package/vendor/serverd/src/routes/management/tunnels.js +21 -1
  78. package/vendor/server-ui/dist/assets/index-Bc5NCMSv.css +0 -1
  79. package/vendor/server-ui/dist/assets/index-DBp3cmaU.js +0 -84
package/vendor/docs/06-reference/config-files.md CHANGED
@@ -4,71 +4,72 @@
4
4
 
5
5
  ## File Overview
6
6
 
7
- | File | Format | Owner | Mode | Purpose |
8
- | ------------------------------------------------------------------ | ---------- | ------------------------ | ---- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
9
- | `/etc/lamalibre/lamaste/panel.json` | JSON | lamaste:lamaste | 0600 | Panel server configuration |
10
- | `/etc/lamalibre/lamaste/tunnels.json` | JSON | lamaste:lamaste | 0600 | Tunnel definitions |
11
- | `/etc/lamalibre/lamaste/sites.json` | JSON | lamaste:lamaste | 0600 | Static site definitions |
12
- | `/etc/lamalibre/lamaste/chisel-credentials.json` | JSON | lamaste:lamaste | 0600 | Per-agent Chisel credentials (source of truth for the authfile) |
13
- | `/etc/lamalibre/lamaste/chisel-users` | JSON | lamaste:lamaste-chisel | 0640 | Chisel `--authfile`: per-agent credentials and port grants (rendered) |
14
- | `/etc/lamalibre/lamaste/chisel-sentinel` | text | lamaste:lamaste | 0600 | Password of the `lamaste-no-grants` sentinel user |
15
- | `/etc/lamalibre/lamaste/chisel-server.key` | PEM | lamaste:lamaste-chisel | 0640 | Chisel SSH host key (`--keyfile`), generated by the panel at onboarding |
16
- | `/etc/authelia/configuration.yml` | YAML | lamaste:lamaste-authelia | 0640 | Authelia server configuration |
17
- | `/etc/authelia/users.yml` | YAML | lamaste:lamaste-authelia | 0660 | User database (Authelia rewrites it on a password change) |
18
- | `/etc/authelia/.secrets.json` | JSON | lamaste:lamaste-authelia | 0600 | Authelia secrets (panel only) |
19
- | `/etc/authelia/oidc-issuer.pem` | PEM | lamaste-authelia | 0600 | RSA-4096 key Authelia signs OIDC tokens with, written by `create-lamaste`; the panel cannot read it |
20
- | `/etc/lamalibre/lamaste/registry-credential.json` | JSON | lamaste:lamaste | 0600 | The panel's registry (Feria) credential: a pasted token, or the `lamaste-server` OIDC client |
21
- | `/etc/lamalibre/lamaste/oidc-clients.json` | JSON | lamaste:lamaste | 0600 | Plaintext secrets (and pbkdf2 salts) of confidential OIDC clients |
22
- | `/etc/lamalibre/lamaste/relay-signing-key.json` | JSON | lamaste:lamaste | 0600 | Ed25519 key relay assertions (panel, Gatekeeper) and agents' app jobs (panel) are signed with |
23
- | `/etc/lamalibre/lamaste/push-install-config.json` | JSON | lamaste:lamaste | 0600 | Push install: the switch, the policies, the default policy |
24
- | `/etc/lamalibre/lamaste/push-install-sessions.json` | JSON | lamaste:lamaste | 0600 | Push install log (last 500 pushes) |
25
- | `/etc/lamalibre/lamaste/ticket-scopes.json` | JSON | lamaste:lamaste | 0600 | Ticket scope registry |
26
- | `/etc/lamalibre/lamaste/tickets.json` | JSON | lamaste:lamaste | 0600 | Ticket and session store |
27
- | `/etc/lamalibre/lamaste/invitations.json` | JSON | lamaste:lamaste | 0600 | Pending user invitations |
28
- | `/etc/lamalibre/lamaste/plugins.json` | JSON | lamaste:lamaste | 0600 | Plugin registry (before 4.2; the registry is now in `state.db`) |
29
- | `/etc/lamalibre/lamaste/state.db` | SQLite | lamaste:lamaste | 0600 | Plugins (with their hooks), agents, tickets, enrollment tokens, the audit log, notifications, relay hook approvals, plugin operations, agent jobs |
30
- | `/etc/lamalibre/lamaste/plugin-hostings.json` | JSON | lamaste:lamaste | 0600 | Hostings of agent-hosted plugins: agent, port, phase, installation secrets, health |
31
- | `/opt/lamalibre/lamaste/hooks/<route>/` | directory | root:root | 0755 | A plugin's approved relay hook module (`<sha256>.mjs`, 0644) and `runner.env`, written by `lamaste-priv` |
32
- | `/etc/lamalibre/lamaste/storage-config.json` | JSON | lamaste:lamaste | 0600 | Storage server registry and plugin bindings (credentials AES-256-GCM encrypted) |
33
- | `/etc/lamalibre/lamaste/storage-master.key` | Binary | lamaste:lamaste | 0600 | 32-byte master key for storage credential encryption |
34
- | `/etc/lamalibre/lamaste/groups.json` | JSON | lamaste:lamaste | 0600 | Lamaste group definitions and membership |
35
- | `/etc/lamalibre/lamaste/access-grants.json` | JSON | lamaste:lamaste | 0600 | Generic access grants (principal → resource) |
36
- | `/etc/lamalibre/lamaste/gatekeeper.json` | JSON | lamaste:lamaste | 0600 | Gatekeeper settings (cache TTL, admin contact, logging) |
37
- | `/etc/lamalibre/lamaste/access-request-log.json` | JSON | lamaste:lamaste | 0600 | Optional denied access log |
38
- | `/etc/lamalibre/lamaste/pki/enrollment-tokens.json` | JSON | lamaste:lamaste | 0600 | One-time enrollment tokens for hardware-bound enrollment |
39
- | `/etc/lamalibre/lamaste/pki/revoked.json` | JSON | lamaste:lamaste | 0600 | Revoked certificate serial numbers |
40
- | `/etc/lamalibre/lamaste/pki/agents/registry.json` | JSON | lamaste:lamaste | 0600 | Agent certificate metadata |
41
- | `/etc/nginx/sites-available/lamalibre-lamaste-*` | nginx conf | root:root | 0644 | Vhost configurations (the panel's are installed by `lamaste-priv`) |
42
- | `/etc/nginx/snippets/lamalibre-lamaste-mtls.conf` | nginx conf | root:root | 0644 | mTLS snippet |
43
- | `/etc/nginx/snippets/lamalibre-lamaste-authz-cache.conf` | nginx conf | root:root | 0644 | Gatekeeper proxy_cache zone |
44
- | `/etc/systemd/system/lamalibre-lamaste-gatekeeper.service` | systemd | root:root | 0644 | Gatekeeper systemd unit |
45
- | `/etc/systemd/system/chisel.service` | systemd | root:root | 0644 | Chisel unit, written by `create-lamaste` |
46
- | `/etc/systemd/system/authelia.service` | systemd | root:root | 0644 | Authelia unit, written by `create-lamaste` |
47
- | `/etc/systemd/system/lamalibre-lamaste-hooks@.socket`, `@.service` | systemd | root:root | 0644 | Relay hook runner (one instance per plugin with relay hooks), written by `create-lamaste` |
48
- | `~/.lamalibre/lamaste/servers.json` | JSON | user | 0600 | Desktop app server registry |
49
- | `~/.lamalibre/lamaste/agents.json` | JSON | user | 0600 | Multi-agent registry |
50
- | `~/.lamalibre/lamaste/agentd.token` | JSON | user | 0600 | Bearer token of lamaste-agentd's owner (the desktop app, scripts run as the user) |
51
- | `~/.lamalibre/lamaste/agents/<label>/config.json` | JSON | user | 0600 | Per-agent configuration |
52
- | `~/.lamalibre/lamaste/agents/<label>/client.p12` | PKCS#12 | user | 0600 | Per-agent mTLS certificate |
53
- | `~/.lamalibre/lamaste/agents/<label>/ca.crt` | PEM | user | 0644 | Per-agent CA certificate |
54
- | `~/.lamalibre/lamaste/agents/<label>/chisel.json` | JSON | user | 0600 | Per-agent Chisel credential (source of truth for the service) |
55
- | `~/.lamalibre/lamaste/agents/<label>/chisel.env` | env file | user | 0600 | Linux only: `AUTH=` for the systemd unit's `EnvironmentFile=` |
56
- | `~/.lamalibre/lamaste/agents/<label>/` | directory | user | 0700 | Per-agent data directory |
57
- | `~/.lamalibre/lamaste/agents/<label>/sync-state.json` | JSON | user | 0600 | Outcome of the last `lamaste-agent sync` |
58
- | `~/.lamalibre/lamaste/agents/<label>/app-plugins/<route>.json` | JSON | user | 0600 | Port and installation secret of a plugin hosted on this agent |
59
- | `~/.lamalibre/lamaste/agents/<label>/app-plugin-tunnel-state.json` | JSON | user | 0600 | The tunnel state last delivered to each hosted plugin's agent half |
60
- | `~/.lamalibre/lamaste/agents/<label>/apphost-state.json` | JSON | user | 0600 | The agent halves the app host helper installed for this agent |
61
- | `~/.lamalibre/lamaste/agents/<label>/host-facts.json` | JSON | user | 0600 | What the agent last reported about its host, and the helper's last answer |
62
- | `~/.lamalibre/lamaste/agents/<label>/app-job-results.json` | JSON | user | 0600 | App job results the relay has not taken yet |
63
- | `~/.lamalibre/lamaste/agents/<label>/logs/` | directory | user | 0700 | Per-agent Chisel and sync log files |
64
- | `~/.lamalibre/lamaste/agent.json` | JSON | user | 0600 | Legacy single-server config |
65
- | `/usr/local/sbin/lamaste-apphost` | Node.js | root:root | 0755 | Agent machine: the app host helper — see [Agent machine: the app host](#agent-machine-the-app-host) |
66
- | `/etc/sudoers.d/lamaste-apphost` | sudoers | root:root | 0440 | Agent machine: lets the agent's user run the helper |
67
- | `/etc/lamalibre/apphost/relays/<label>.json` | JSON | root:root | 0644 | Agent machine: the relay key pinned for agent `<label>` |
68
- | `/opt/lamalibre/apps/<route>/` | directory | root:root | 0755 | Agent machine: an agent half's installed versions |
69
- | `/var/lib/lamalibre/apps/<route>/` | directory | lamaste-app-\<route\> | 0700 | Agent machine: an agent half's data |
70
- | `/etc/lamalibre/apps/<route>/plugin-config.json` | JSON | lamaste-app-\<route\> | 0600 | Agent machine: an agent half's port and installation secret |
71
- | `/etc/systemd/system/lamalibre-app-<route>.service` | systemd | root:root | 0644 | Agent machine: an agent half's unit |
7
+ | File | Format | Owner | Mode | Purpose |
8
+ | ------------------------------------------------------------------ | ---------- | ------------------------ | ---- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
9
+ | `/etc/lamalibre/lamaste/panel.json` | JSON | lamaste:lamaste | 0600 | Panel server configuration |
10
+ | `/etc/lamalibre/lamaste/tunnels.json` | JSON | lamaste:lamaste | 0600 | Tunnel definitions |
11
+ | `/etc/lamalibre/lamaste/sites.json` | JSON | lamaste:lamaste | 0600 | Static site definitions |
12
+ | `/etc/lamalibre/lamaste/chisel-credentials.json` | JSON | lamaste:lamaste | 0600 | Per-agent Chisel credentials (source of truth for the authfile) |
13
+ | `/etc/lamalibre/lamaste/chisel-users` | JSON | lamaste:lamaste-chisel | 0640 | Chisel `--authfile`: per-agent credentials and port grants (rendered) |
14
+ | `/etc/lamalibre/lamaste/chisel-sentinel` | text | lamaste:lamaste | 0600 | Password of the `lamaste-no-grants` sentinel user |
15
+ | `/etc/lamalibre/lamaste/chisel-server.key` | PEM | lamaste:lamaste-chisel | 0640 | Chisel SSH host key (`--keyfile`), generated by the panel at onboarding |
16
+ | `/etc/authelia/configuration.yml` | YAML | lamaste:lamaste-authelia | 0640 | Authelia server configuration |
17
+ | `/etc/authelia/users.yml` | YAML | lamaste:lamaste-authelia | 0660 | User database (Authelia rewrites it on a password change) |
18
+ | `/etc/authelia/.secrets.json` | JSON | lamaste:lamaste-authelia | 0600 | Authelia secrets (panel only) |
19
+ | `/etc/authelia/oidc-issuer.pem` | PEM | lamaste-authelia | 0600 | RSA-4096 key Authelia signs OIDC tokens with, written by `create-lamaste`; the panel cannot read it |
20
+ | `/etc/lamalibre/lamaste/registry-credential.json` | JSON | lamaste:lamaste | 0600 | The panel's registry (Feria) credential: a pasted token, or the `lamaste-server` OIDC client |
21
+ | `/etc/lamalibre/lamaste/oidc-clients.json` | JSON | lamaste:lamaste | 0600 | Plaintext secrets (and pbkdf2 salts) of confidential OIDC clients |
22
+ | `/etc/lamalibre/lamaste/relay-signing-key.json` | JSON | lamaste:lamaste | 0600 | Ed25519 key relay assertions (panel, Gatekeeper) and agents' app jobs (panel) are signed with |
23
+ | `/etc/lamalibre/lamaste/push-install-config.json` | JSON | lamaste:lamaste | 0600 | Push install: the switch, the policies, the default policy |
24
+ | `/etc/lamalibre/lamaste/push-install-sessions.json` | JSON | lamaste:lamaste | 0600 | Push install log (last 500 pushes) |
25
+ | `/etc/lamalibre/lamaste/ticket-scopes.json` | JSON | lamaste:lamaste | 0600 | Ticket scope registry |
26
+ | `/etc/lamalibre/lamaste/tickets.json` | JSON | lamaste:lamaste | 0600 | Ticket and session store |
27
+ | `/etc/lamalibre/lamaste/invitations.json` | JSON | lamaste:lamaste | 0600 | Pending user invitations |
28
+ | `/etc/lamalibre/lamaste/plugins.json` | JSON | lamaste:lamaste | 0600 | Plugin registry (before 4.2; the registry is now in `state.db`) |
29
+ | `/etc/lamalibre/lamaste/state.db` | SQLite | lamaste:lamaste | 0600 | Plugins (with their hooks), agents, tickets, enrollment tokens, the audit log, notifications, relay hook approvals, plugin operations, agent jobs, the cache of agent-hosted plugins' settings (never a secret), each agent's last contact |
30
+ | `/etc/lamalibre/lamaste/plugin-hostings.json` | JSON | lamaste:lamaste | 0600 | Hostings of agent-hosted plugins: agent, port, phase, installation secrets, health |
31
+ | `/opt/lamalibre/lamaste/hooks/<route>/` | directory | root:root | 0755 | A plugin's approved relay hook module (`<sha256>.mjs`, 0644) and `runner.env`, written by `lamaste-priv` |
32
+ | `/etc/lamalibre/lamaste/storage-config.json` | JSON | lamaste:lamaste | 0600 | Storage server registry and plugin bindings (credentials AES-256-GCM encrypted) |
33
+ | `/etc/lamalibre/lamaste/storage-master.key` | Binary | lamaste:lamaste | 0600 | 32-byte master key for storage credential encryption |
34
+ | `/etc/lamalibre/lamaste/groups.json` | JSON | lamaste:lamaste | 0600 | Lamaste group definitions and membership |
35
+ | `/etc/lamalibre/lamaste/access-grants.json` | JSON | lamaste:lamaste | 0600 | Generic access grants (principal → resource) |
36
+ | `/etc/lamalibre/lamaste/gatekeeper.json` | JSON | lamaste:lamaste | 0600 | Gatekeeper settings (cache TTL, admin contact, logging) |
37
+ | `/etc/lamalibre/lamaste/access-request-log.json` | JSON | lamaste:lamaste | 0600 | Optional denied access log |
38
+ | `/etc/lamalibre/lamaste/pki/enrollment-tokens.json` | JSON | lamaste:lamaste | 0600 | One-time enrollment tokens for hardware-bound enrollment |
39
+ | `/etc/lamalibre/lamaste/pki/revoked.json` | JSON | lamaste:lamaste | 0600 | Revoked certificate serial numbers |
40
+ | `/etc/lamalibre/lamaste/pki/agents/registry.json` | JSON | lamaste:lamaste | 0600 | Agent certificate metadata |
41
+ | `/etc/nginx/sites-available/lamalibre-lamaste-*` | nginx conf | root:root | 0644 | Vhost configurations (the panel's are installed by `lamaste-priv`) |
42
+ | `/etc/nginx/snippets/lamalibre-lamaste-mtls.conf` | nginx conf | root:root | 0644 | mTLS snippet |
43
+ | `/etc/nginx/snippets/lamalibre-lamaste-authz-cache.conf` | nginx conf | root:root | 0644 | Gatekeeper proxy_cache zone |
44
+ | `/etc/systemd/system/lamalibre-lamaste-gatekeeper.service` | systemd | root:root | 0644 | Gatekeeper systemd unit |
45
+ | `/etc/systemd/system/chisel.service` | systemd | root:root | 0644 | Chisel unit, written by `create-lamaste` |
46
+ | `/etc/systemd/system/authelia.service` | systemd | root:root | 0644 | Authelia unit, written by `create-lamaste` |
47
+ | `/etc/systemd/system/lamalibre-lamaste-hooks@.socket`, `@.service` | systemd | root:root | 0644 | Relay hook runner (one instance per plugin with relay hooks), written by `create-lamaste` |
48
+ | `~/.lamalibre/lamaste/servers.json` | JSON | user | 0600 | Desktop app server registry |
49
+ | `~/.lamalibre/lamaste/agents.json` | JSON | user | 0600 | Multi-agent registry |
50
+ | `~/.lamalibre/lamaste/agentd.token` | JSON | user | 0600 | Bearer token of lamaste-agentd's owner (the desktop app, scripts run as the user) |
51
+ | `~/.lamalibre/lamaste/agents/<label>/config.json` | JSON | user | 0600 | Per-agent configuration |
52
+ | `~/.lamalibre/lamaste/agents/<label>/client.p12` | PKCS#12 | user | 0600 | Per-agent mTLS certificate |
53
+ | `~/.lamalibre/lamaste/agents/<label>/ca.crt` | PEM | user | 0644 | Per-agent CA certificate |
54
+ | `~/.lamalibre/lamaste/agents/<label>/chisel.json` | JSON | user | 0600 | Per-agent Chisel credential (source of truth for the service) |
55
+ | `~/.lamalibre/lamaste/agents/<label>/chisel.env` | env file | user | 0600 | Linux only: `AUTH=` for the systemd unit's `EnvironmentFile=` |
56
+ | `~/.lamalibre/lamaste/agents/<label>/` | directory | user | 0700 | Per-agent data directory |
57
+ | `~/.lamalibre/lamaste/agents/<label>/sync-state.json` | JSON | user | 0600 | Outcome of the last `lamaste-agent sync` |
58
+ | `~/.lamalibre/lamaste/agents/<label>/app-plugins/<route>.json` | JSON | user | 0600 | Port and installation secret of a plugin hosted on this agent |
59
+ | `~/.lamalibre/lamaste/agents/<label>/app-plugin-tunnel-state.json` | JSON | user | 0600 | The tunnel state last delivered to each hosted plugin's agent half |
60
+ | `~/.lamalibre/lamaste/agents/<label>/apphost-state.json` | JSON | user | 0600 | The agent halves the app host helper installed for this agent |
61
+ | `~/.lamalibre/lamaste/agents/<label>/host-facts.json` | JSON | user | 0600 | What the agent last reported about its host, and the helper's last answer |
62
+ | `~/.lamalibre/lamaste/agents/<label>/app-job-results.json` | JSON | user | 0600 | App job results the relay has not taken yet |
63
+ | `~/.lamalibre/lamaste/agents/<label>/logs/` | directory | user | 0700 | Per-agent Chisel and sync log files |
64
+ | `~/.lamalibre/lamaste/agent.json` | JSON | user | 0600 | Legacy single-server config |
65
+ | `/usr/local/sbin/lamaste-apphost` | Node.js | root:root | 0755 | Agent machine: the app host helper — see [Agent machine: the app host](#agent-machine-the-app-host) |
66
+ | `/etc/sudoers.d/lamaste-apphost` | sudoers | root:root | 0440 | Agent machine: lets the agent's user run the helper |
67
+ | `/etc/lamalibre/apphost/relays/<label>.json` | JSON | root:root | 0644 | Agent machine: the relay key pinned for agent `<label>` |
68
+ | `/opt/lamalibre/apps/<route>/` | directory | root:root | 0755 | Agent machine: an agent half's installed versions |
69
+ | `/var/lib/lamalibre/apps/<route>/` | directory | lamaste-app-\<route\> | 0700 | Agent machine: an agent half's data |
70
+ | `/etc/lamalibre/apps/<route>/plugin-config.json` | JSON | lamaste-app-\<route\> | 0600 | Agent machine: an agent half's port and installation secret |
71
+ | `/etc/systemd/system/lamalibre-app-<route>.service` | systemd | root:root | 0644 | Agent machine: an agent half's unit |
72
+ | `/etc/systemd/system/lamalibre-app-<route>.socket` | systemd | root:root | 0644 | Agent machine: the socket unit holding an agent half's port |
72
73
 
73
74
  ---
74
75
 
@@ -823,6 +824,9 @@ Stores the server registry for the desktop app's multi-server support. Created b
823
824
  | `adminAuth.method` | string | `"p12"` or `"keychain"` — how the admin cert is stored |
824
825
  | `adminAuth.p12Path` | string \| null | Path to admin P12 file (when method is `"p12"`) |
825
826
  | `adminAuth.keychainIdentity` | string \| null | Keychain identity for admin cert (when method is `"keychain"`) |
827
+ | `panelServerPubkeySha256` | string | The pin of the panel's TLS key for a panel reached at its IP address (see below) |
828
+ | `panelServerPinnedAt` | string | ISO 8601 timestamp of the pin |
829
+ | `panelServerPinSource` | string | `ssh`, `installer`, `local`, `agent`, `first-use` or `re-pin` (see below) |
826
830
 
827
831
  **Example:**
828
832
 
@@ -853,6 +857,8 @@ Stores the server registry for the desktop app's multi-server support. Created b
853
857
 
854
858
  **Notes on `adminAuth`:** When `adminAuth` is present and valid, the desktop app shows the Agents/Servers mode toggle in the sidebar. Cloud-provisioned servers populate `adminAuth` automatically (the admin certificate is downloaded during provisioning). For manually added servers, the user must import an admin certificate to enable Server mode.
855
859
 
860
+ **Panel key pin:** At its IP address (`https://<ip>:9292`) the panel serves a self-signed certificate, so the app verifies every call to it by `panelServerPubkeySha256` — the base64 SHA-256 of the certificate's public key (SubjectPublicKeyInfo), curl's `--pinnedpubkey sha256//…` form and the same value an agent's config holds. `panelServerPinSource` says where it came from: `ssh` (read from the server over SSH by cloud provisioning or an admin recovery), `installer` (a local install, from the installer's report), `local` (a local install imported, or installed by an older installer: read from the certificate file through `pkexec`), `agent` (migrated from the agent's `agent.json`), `first-use` (taken from the first connection) or `re-pin` (the user replaced it on the Servers page, the only way it changes). A panel reached at its domain has no pin: its Let's Encrypt certificate is verified normally. `sudo lamaste-server panel-pin` on the relay prints the value to compare with.
861
+
856
862
  **P12 password:** Not stored in the JSON file. Retrieved from the OS credential store (`com.lamalibre.lamaste.server` service, keyed by server UUID).
857
863
 
858
864
  **Cloud API token:** Not stored in this file. Retrieved from the OS credential store (`com.lamalibre.cloud` service).
@@ -910,7 +916,7 @@ The directory itself is mode 0700 (re-applied on every sync).
910
916
  - `plugins/` — per-plugin data directories
911
917
  - `app-plugins/<route>.json` — the port and installation secret of a plugin hosted on this agent (mode 0600): `{ plugin, port, secret, issuedAt, previousSecret?, previousIssuedAt?, fetchedAt, acknowledged }`
912
918
  - `apphost-state.json` — the agent halves the app host helper installed for this agent (mode 0600): `{ "apps": { "<route>": { "version": "1.0.0", "updatedAt": "…" } } }`. Written by the sync's app jobs; read by converge, which hands a fetched plugin config to the service of a route listed here before acknowledging it. When it cannot be read the sync rebuilds it from the helper's owner records naming this label
913
- - `host-facts.json` — what was last reported as host facts and the helper's last answer (mode 0600): `{ "reported": { "hash", "at" } | null, "apphost": { "helper": "<dev:ino:size:mtime>", "facts": { "version", "node" } | null, "at" } | null }`. Facts are reported when their hash changes or a day passed; the helper is asked again when its file changes or a day passed
919
+ - `host-facts.json` — what was last reported as host facts and the helper's last answer (mode 0600): `{ "reported": { "hash", "at" } | null, "apphost": { "helper": "<dev:ino:size:mtime>", "facts": { "version", "node" } | null, "at" } | null }`. Facts are reported when their hash changes, when the relay's agent-config `hostFactsHash` (the hash of the facts it stores, `null` for none) is not theirs, or a day passed; the helper is asked again when its file changes or a day passed
914
920
  - `app-job-results.json` — results of app jobs the relay has not taken yet (mode 0600): `{ "<jobId>": { "result", "deadlineAt" } }` — a signed job runs once, so a report that failed is made again from here, until the job's deadline
915
921
 
916
922
  An install job packs the agent package in `~/.lamalibre/lamaste/tmp/agent/apphost-*/` (0700, with a throw-away npm userconfig holding the brokered registry token) and deletes it afterwards.
@@ -920,7 +926,7 @@ Service files use per-agent names:
920
926
  - macOS: `com.lamalibre.lamaste.chisel-<label>` (plist label), `~/Library/LaunchAgents/com.lamalibre.lamaste.chisel-<label>.plist` — mode 0600, because it carries `AUTH` in `EnvironmentVariables`
921
927
  - Linux: `lamalibre-lamaste-chisel-<label>` (unit name), `~/.config/systemd/user/lamalibre-lamaste-chisel-<label>.service` — a systemd **user** unit with `EnvironmentFile=` pointing at `chisel.env`; enable lingering (`sudo loginctl enable-linger <user>`) for it to start at boot without a login
922
928
 
923
- Both run `chisel client --max-retry-interval 30s https://tunnel.<domain>:443 R:127.0.0.1:<port>:127.0.0.1:<port> ...` with TLS verification and no credential in argv. They are generated by `@lamalibre/lamaste@4.3.0/agent` (`chisel-service.ts`) and rewritten by `lamaste-agent setup`, `update` and `sync` — do not edit them by hand. An agent carrying no tunnels has its service unloaded (Chisel cannot run without a remote).
929
+ Both run `chisel client --max-retry-interval 30s https://tunnel.<domain>:443 R:127.0.0.1:<port>:127.0.0.1:<port> ...` with TLS verification and no credential in argv. They are generated by `@lamalibre/lamaste@4.4.0/agent` (`chisel-service.ts`) and rewritten by `lamaste-agent setup`, `update` and `sync` — do not edit them by hand. An agent carrying no tunnels has its service unloaded (Chisel cannot run without a remote).
924
930
 
925
931
  The sync timer, which runs `<node> <installed lamaste-agent> sync --label <label> --quiet` (`<node>` is a stable path such as `/opt/homebrew/bin/node` when one on `PATH` resolves to the running binary, so a Node.js upgrade does not break it):
926
932
 
@@ -946,26 +952,29 @@ Legacy single-server configuration. Automatically migrated to the multi-agent re
946
952
 
947
953
  On a Linux agent where the operator ran `sudo lamaste-agent apphost enable`, the root helper `lamaste-apphost` installs the agent halves of the plugins the panel hosts there ([App Host](../04-api-reference/app-host.md)). Every path below is derived from a validated route or agent label; root writes them atomically (temp file, `fsync`, rename) and refuses to use one that is not what it expects — a directory another user can write, a link where a file belongs.
948
954
 
949
- | Path | Owner | Mode | Contents |
950
- | --------------------------------------------------- | ---------------------------- | --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
951
- | `/usr/local/sbin/lamaste-apphost` | root:root | 0755 | The helper — copied by `enable` from a root-owned `lamaste-agent` install |
952
- | `/etc/sudoers.d/lamaste-apphost` | root:root | 0440 | `<user> ALL=(root) NOPASSWD: /usr/local/sbin/lamaste-apphost`, with `env_reset`, `!setenv` and Node.js variables deleted; checked with `visudo -c` before it is renamed into place. None when the agent runs as root |
953
- | `/etc/lamalibre/apphost/relays/<label>.json` | root:root | 0644 (dirs 0755) | The relay key pinned for agent `<label>`: `{ v, label, agent, kid, publicKey, panelUrl, pinnedAt }` — public material |
954
- | `/opt/lamalibre/apps/<route>/<version>/` | root:root | dirs 0755, files 0644 | The package as published (`package/`) and `apphost.json`, the spec it was installed with |
955
- | `/opt/lamalibre/apps/<route>/current`, `previous` | root:root | symlinks | The running version and the one before it; other versions are deleted |
956
- | `/opt/lamalibre/apps/.stage-<hex>-<route>/` | root:root | 0700 | Unpacking while an install runs |
957
- | `/var/lib/lamalibre/apps/<route>/` | the agent half's account | 0700 | The agent half's data (`LAMASTE_APP_DATA_DIR`) — kept on removal, deleted by a purge |
958
- | `/var/lib/lamalibre/apps/.owners/<route>.json` | root:root | 0644 (dir 0755) | Who owns the route on this machine: `{ route, package, label, since }` — kept on removal, deleted by a purge |
959
- | `/var/lib/lamalibre/apps/.jobs/used.json` | root:root | 0600 (dir 0700) | `{ v: 1, jobs: { <jobId>: <expiry, ms> } }` — the signed jobs that ran, each until it expires |
960
- | `/var/lib/lamalibre/apps/.trash/` | root:root | 0700 | Purged data, deleted there |
961
- | `/etc/lamalibre/apps/<route>/` | root:\<the account's group\> | 0750 | The agent half's configuration directory |
962
- | `/etc/lamalibre/apps/<route>/plugin-config.json` | the agent half's account | 0600 | Port and installation secret (`LAMASTE_APP_CONFIG`), the shape of the agent's `app-plugins/<route>.json` |
963
- | `/etc/systemd/system/lamalibre-app-<route>.service` | root:root | 0644 | The agent half's unit, from a fixed template — paths, never secrets |
964
- | `/run/lamaste-apphost.lock` | root:root | 0600 | Held (with the owner's PID) while a mutating helper command runs |
955
+ | Path | Owner | Mode | Contents |
956
+ | --------------------------------------------------- | ---------------------------- | --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
957
+ | `/usr/local/sbin/lamaste-apphost` | root:root | 0755 | The helper — copied by `enable` from a root-owned `lamaste-agent` install |
958
+ | `/etc/sudoers.d/lamaste-apphost` | root:root | 0440 | `<user> ALL=(root) NOPASSWD: /usr/local/sbin/lamaste-apphost`, with `env_reset`, `!setenv` and Node.js variables deleted; checked with `visudo -c` before it is renamed into place. None when the agent runs as root |
959
+ | `/etc/lamalibre/apphost/relays/<label>.json` | root:root | 0644 (dirs 0755) | The relay key pinned for agent `<label>`: `{ v, label, agent, kid, publicKey, panelUrl, pinnedAt }` — public material |
960
+ | `/opt/lamalibre/apps/<route>/<version>/` | root:root | dirs 0755, files 0644 | The package as published (`package/`) and `apphost.json`, the spec it was installed with |
961
+ | `/opt/lamalibre/apps/<route>/current`, `previous` | root:root | symlinks | The running version and the one before it; other versions are deleted |
962
+ | `/opt/lamalibre/apps/.stage-<hex>-<route>/` | root:root | 0700 | Unpacking while an install runs |
963
+ | `/var/lib/lamalibre/apps/<route>/` | the agent half's account | 0700 | The agent half's data (`LAMASTE_APP_DATA_DIR`) — kept on removal, deleted by a purge |
964
+ | `/var/lib/lamalibre/apps/<route>/settings.json` | the agent half's account | 0600 | The plugin's non-secret settings and their revision, written by the agent half (`createSettingsStore`) — never a secret |
965
+ | `/var/lib/lamalibre/apps/<route>/secrets.json` | the agent half's account | 0600 | The plugin's secret settings, each with when it was set — the only place they rest |
966
+ | `/var/lib/lamalibre/apps/.owners/<route>.json` | root:root | 0644 (dir 0755) | Who owns the route on this machine: `{ route, package, label, since }` — kept on removal, deleted by a purge |
967
+ | `/var/lib/lamalibre/apps/.jobs/used.json` | root:root | 0600 (dir 0700) | `{ v: 1, jobs: { <jobId>: <expiry, ms> } }` — the signed jobs that ran, each until it expires |
968
+ | `/var/lib/lamalibre/apps/.trash/` | root:root | 0700 | Purged data, deleted there |
969
+ | `/etc/lamalibre/apps/<route>/` | root:\<the account's group\> | 0750 | The agent half's configuration directory |
970
+ | `/etc/lamalibre/apps/<route>/plugin-config.json` | the agent half's account | 0600 | Port and installation secret (`LAMASTE_APP_CONFIG`), the shape of the agent's `app-plugins/<route>.json` |
971
+ | `/etc/systemd/system/lamalibre-app-<route>.service` | root:root | 0644 | The agent half's unit, from a fixed template — paths, never secrets |
972
+ | `/etc/systemd/system/lamalibre-app-<route>.socket` | root:root | 0644 | The socket unit holding the agent half's port: `ListenStream=127.0.0.1:<port>` from the plugin config, `Accept=no`, `NoDelay=true`, `Service=` the unit; systemd passes the socket to the agent half on every start. Written once the plugin config is there, rewritten only when it changes (see [The socket unit](../04-api-reference/app-host.md#the-socket-unit)) |
973
+ | `/run/lamaste-apphost.lock` | root:root | 0600 | Held (with the owner's PID) while a mutating helper command runs |
965
974
 
966
975
  The agent half's account and group are `lamaste-app-<route>` for routes of up to 18 characters, `lamaste-app-<first 2 characters>-<16 hex digits of SHA-256(route)>` otherwise; the account's comment is `lamaste-app route=<route>`. `/opt/lamalibre`, `/opt/lamalibre/apps`, `/var/lib/lamalibre`, `/var/lib/lamalibre/apps`, `/etc/lamalibre` and `/etc/lamalibre/apps` are root-owned 0755.
967
976
 
968
- `sudo lamaste-agent apphost disable` removes the rule, the helper and the pins (and `/etc/lamalibre/apphost` when it is empty). Removing an agent half deletes its unit, code and configuration directory; a purge also deletes its data directory, account and owner record. System packages are never removed.
977
+ `sudo lamaste-agent apphost disable` removes the rule, the helper and the pins (and `/etc/lamalibre/apphost` when it is empty). Removing an agent half stops and deletes its unit and its socket unit — releasing its port — with any drop-in directory of the unit, and deletes its code and configuration directory; a purge also deletes its data directory, account and owner record. System packages are never removed.
969
978
 
970
979
  ---
971
980
 
@@ -1210,6 +1219,7 @@ WantedBy=multi-user.target
1210
1219
  | `/etc/lamalibre/apps/<route>/` | root:lamaste-app-\<route\> | 0750 | Agent half config directory (agent machine) |
1211
1220
  | `/etc/lamalibre/apps/<route>/plugin-config.json` | lamaste-app-\<route\> | 0600 | Agent half port and secret (agent machine) |
1212
1221
  | `/etc/systemd/system/lamalibre-app-<route>.service` | root:root | 0644 | Agent half unit (agent machine) |
1222
+ | `/etc/systemd/system/lamalibre-app-<route>.socket` | root:root | 0644 | Agent half socket unit, holds its port (agent machine) |
1213
1223
 
1214
1224
  ## Quick Reference
1215
1225
 
package/vendor/docs/06-reference/glossary.md CHANGED
@@ -24,7 +24,7 @@ If you are reading documentation and hit an unfamiliar term, this is the place t
24
24
 
25
25
  **Where it appears:**
26
26
 
27
- - Enrolled from the panel (**Certificates → Enrollment Token**) and `lamaste-agent setup` (installed globally with `npm install -g @lamalibre/lamaste-agent@4.3.0`)
27
+ - Enrolled from the panel (**Certificates → Enrollment Token**) and `lamaste-agent setup` (installed globally with `npm install -g @lamalibre/lamaste-agent@4.4.0`)
28
28
  - Agent registry: `/etc/lamalibre/lamaste/agents.json` on the server; `~/.lamalibre/lamaste/agents/<label>/` on the agent
29
29
  - The **Agent** column and field on the panel's Tunnels page
30
30
 
@@ -242,7 +242,7 @@ See also: [mTLS](#mtls-mutual-tls), [CA](#ca-certificate-authority), [PKCS12](#p
242
242
 
243
243
  **Where it appears:**
244
244
 
245
- - Generated by `lamaste-agent setup` / `update` (implementation in `@lamalibre/lamaste@4.3.0/agent`)
245
+ - Generated by `lamaste-agent setup` / `update` (implementation in `@lamalibre/lamaste@4.4.0/agent`)
246
246
  - Installed to `~/Library/LaunchAgents/com.lamalibre.lamaste.chisel-<label>.plist` on the agent
247
247
  - Manages the Chisel client process lifecycle
248
248
 
@@ -373,7 +373,7 @@ See also: [Client Certificate](#client-certificate), [CA](#ca-certificate-author
373
373
 
374
374
  **Plain English:** A small scheduled job on every agent that checks with the panel every 30 seconds and adjusts the tunnel client when the agent's tunnels changed — so tunnels created, disabled or moved in the panel reach the agent without anyone running a command on it.
375
375
 
376
- **Technical:** Runs `lamaste-agent sync --label <label>`, which fetches `GET /api/tunnels/agent-config` and converges the agent's Chisel client with it (relay URL, credential, pinned binary, granted remotes, running or stopped). It exists because Chisel rejects a client's whole session when one requested remote is not granted: an agent must drop a revoked tunnel promptly or all its other tunnels go dark. Requires a global install of `@lamalibre/lamaste-agent@4.3.0`.
376
+ **Technical:** Runs `lamaste-agent sync --label <label>`, which fetches `GET /api/tunnels/agent-config` and converges the agent's Chisel client with it (relay URL, credential, pinned binary, granted remotes, running or stopped). It exists because Chisel rejects a client's whole session when one requested remote is not granted: an agent must drop a revoked tunnel promptly or all its other tunnels go dark. Requires a global install of `@lamalibre/lamaste-agent@4.4.0`.
377
377
 
378
378
  **Where it appears:**
379
379
 
package/vendor/docs/06-reference/installer-flags.md CHANGED
@@ -1,11 +1,11 @@
1
1
  # Installer Flags
2
2
 
3
- > CLI flags, environment variables, and exit codes for `npx @lamalibre/create-lamaste@4.3.0`.
3
+ > CLI flags, environment variables, and exit codes for `npx @lamalibre/create-lamaste@4.4.0`.
4
4
 
5
5
  ## Usage
6
6
 
7
7
  ```bash
8
- npx @lamalibre/create-lamaste@4.3.0 [flags]
8
+ npx @lamalibre/create-lamaste@4.4.0 [flags]
9
9
  ```
10
10
 
11
11
  The installer runs as root on a fresh Ubuntu 24.04 server. It is completely non-interactive by default — all configuration happens later through the browser-based onboarding wizard.
@@ -26,7 +26,7 @@ The installer runs as root on a fresh Ubuntu 24.04 server. It is completely non-
26
26
  Prints a description of what the installer does, lists all flags, and exits with code 0. Does not modify anything on the system.
27
27
 
28
28
  ```bash
29
- npx @lamalibre/create-lamaste@4.3.0 --help
29
+ npx @lamalibre/create-lamaste@4.4.0 --help
30
30
  ```
31
31
 
32
32
  ### `--yes`, `-y`
@@ -34,7 +34,7 @@ npx @lamalibre/create-lamaste@4.3.0 --help
34
34
  Skips the interactive confirmation prompt that appears before installation begins. Useful for automated deployments or scripts where you cannot press Enter.
35
35
 
36
36
  ```bash
37
- npx @lamalibre/create-lamaste@4.3.0 --yes
37
+ npx @lamalibre/create-lamaste@4.4.0 --yes
38
38
  ```
39
39
 
40
40
  Without this flag, the installer displays a banner listing all changes it will make and waits for the user to press Enter or Ctrl+C.
@@ -51,7 +51,7 @@ Skips all OS hardening tasks:
51
51
  Everything else (Node.js, nginx, mTLS, panel deployment) still runs.
52
52
 
53
53
  ```bash
54
- npx @lamalibre/create-lamaste@4.3.0 --skip-harden
54
+ npx @lamalibre/create-lamaste@4.4.0 --skip-harden
55
55
  ```
56
56
 
57
57
  Use this if you manage your own firewall rules, already have fail2ban configured, or are running on a platform that handles security at a different layer.
@@ -61,7 +61,7 @@ Use this if you manage your own firewall rules, already have fail2ban configured
61
61
  Allows the installer to run on a machine with a private or non-routable IP address (e.g., `192.168.x.x`, `10.x.x.x`). By default, the installer requires a public IP.
62
62
 
63
63
  ```bash
64
- npx @lamalibre/create-lamaste@4.3.0 --dev
64
+ npx @lamalibre/create-lamaste@4.4.0 --dev
65
65
  ```
66
66
 
67
67
  This is useful for:
@@ -76,7 +76,7 @@ When `--dev` is active, the installer prints the detected IP with a note: `(dev
76
76
  Forces the installer to run the complete installation pipeline, ignoring skip guards that would normally detect an existing installation. This is useful when an installation is in an inconsistent state and you want to ensure all components are fully deployed.
77
77
 
78
78
  ```bash
79
- npx @lamalibre/create-lamaste@4.3.0 --force-full
79
+ npx @lamalibre/create-lamaste@4.4.0 --force-full
80
80
  ```
81
81
 
82
82
  Use this if:
@@ -90,7 +90,7 @@ Use this if:
90
90
  Prints a step-by-step guide for manually removing Lamaste from the server, then exits with code 0. Does not modify anything on the system.
91
91
 
92
92
  ```bash
93
- npx @lamalibre/create-lamaste@4.3.0 --uninstall
93
+ npx @lamalibre/create-lamaste@4.4.0 --uninstall
94
94
  ```
95
95
 
96
96
  The printed guide first points to the automated removal, `sudo lamaste-server uninstall`, then covers:
@@ -207,25 +207,25 @@ Components that are always redeployed on re-run:
207
207
 
208
208
  ```bash
209
209
  ssh root@203.0.113.42
210
- npx @lamalibre/create-lamaste@4.3.0
210
+ npx @lamalibre/create-lamaste@4.4.0
211
211
  ```
212
212
 
213
213
  **Automated install (no confirmation prompt):**
214
214
 
215
215
  ```bash
216
- npx @lamalibre/create-lamaste@4.3.0 --yes
216
+ npx @lamalibre/create-lamaste@4.4.0 --yes
217
217
  ```
218
218
 
219
219
  **Install without OS hardening:**
220
220
 
221
221
  ```bash
222
- npx @lamalibre/create-lamaste@4.3.0 --yes --skip-harden
222
+ npx @lamalibre/create-lamaste@4.4.0 --yes --skip-harden
223
223
  ```
224
224
 
225
225
  **Test in a local VM:**
226
226
 
227
227
  ```bash
228
- npx @lamalibre/create-lamaste@4.3.0 --dev
228
+ npx @lamalibre/create-lamaste@4.4.0 --dev
229
229
  ```
230
230
 
231
231
  **Update an existing installation:**
@@ -237,7 +237,7 @@ npx @lamalibre/create-lamaste@latest --yes
237
237
  **View the uninstall guide:**
238
238
 
239
239
  ```bash
240
- npx @lamalibre/create-lamaste@4.3.0 --uninstall
240
+ npx @lamalibre/create-lamaste@4.4.0 --uninstall
241
241
  ```
242
242
 
243
243
  ## Quick Reference
package/vendor/docs/06-reference/ports-and-services.md CHANGED
@@ -34,7 +34,7 @@ A tunnel's port is also a loopback port on the relay: its vhost proxies to `127.
34
34
  | 9292 | IP-based panel listener |
35
35
  | 9294 | Gatekeeper |
36
36
 
37
- A tunnel on one of them would publish that internal service on a public hostname. For the panel that is an administrator takeover, not a leak: the panel trusts the client-certificate headers nginx sets. `RESERVED_TUNNEL_PORTS` in `@lamalibre/lamaste@4.3.0` is enforced by the request schema, inside the tunnel workflow, and again when the Chisel grants are rendered. Tunnel ports must also be 1024–65535.
37
+ A tunnel on one of them would publish that internal service on a public hostname. For the panel that is an administrator takeover, not a leak: the panel trusts the client-certificate headers nginx sets. `RESERVED_TUNNEL_PORTS` in `@lamalibre/lamaste@4.4.0` is enforced by the request schema, inside the tunnel workflow, and again when the Chisel grants are rendered. Tunnel ports must also be 1024–65535.
38
38
 
39
39
  ## Systemd Units
40
40
 
package/vendor/docs/06-reference/troubleshooting.md CHANGED
@@ -217,7 +217,7 @@ The agent's sync timer applies tunnel changes within about 30 seconds. If that d
217
217
  lamaste-agent update # apply now and (re)install the sync timer
218
218
  ```
219
219
 
220
- `update` needs the agent installed globally (`npm install -g @lamalibre/lamaste-agent@4.3.0`); an agent originally set up with `npx` must be installed first.
220
+ `update` needs the agent installed globally (`npm install -g @lamalibre/lamaste-agent@4.4.0`); an agent originally set up with `npx` must be installed first.
221
221
 
222
222
  **Cause 3: The agent does not carry the tunnel.**
223
223
 
@@ -320,7 +320,7 @@ ls -la /usr/local/bin/authelia
320
320
  | Missing `panel.json` | `Config file not found` | Re-run installer or create the file manually |
321
321
  | Invalid JSON in `panel.json` | `contains invalid JSON` | Fix the JSON syntax |
322
322
  | Port 3100 in use | `EADDRINUSE` | Find and stop the conflicting process: `sudo ss -tlnp sport = :3100` |
323
- | Missing Node.js modules | `Cannot find module` | Re-run the installer (`npx @lamalibre/create-lamaste@4.3.0 --yes`); `/opt/lamalibre/lamaste` is root-owned and redeployed as a whole |
323
+ | Missing Node.js modules | `Cannot find module` | Re-run the installer (`npx @lamalibre/create-lamaste@4.4.0 --yes`); `/opt/lamalibre/lamaste` is root-owned and redeployed as a whole |
324
324
  | Permission denied writing state | `EACCES` under `/etc/lamalibre/lamaste` | Re-run the installer; the redeploy re-applies the ownership of the config and PKI directories |
325
325
 
326
326
  ### chisel fails to start
@@ -329,7 +329,7 @@ ls -la /usr/local/bin/authelia
329
329
 
330
330
  | Cause | Log Message | Fix |
331
331
  | -------------------------- | ------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
332
- | Binary missing | `exec format error` or `not found` | Re-run the installer (`npx @lamalibre/create-lamaste@4.3.0 --yes`) — it installs the pinned, checksum-verified release for the server's architecture; the panel cannot install binaries |
332
+ | Binary missing | `exec format error` or `not found` | Re-run the installer (`npx @lamalibre/create-lamaste@4.4.0 --yes`) — it installs the pinned, checksum-verified release for the server's architecture; the panel cannot install binaries |
333
333
  | Not the pinned release | (panel log) `The installed chisel is not the pinned release — run create-lamaste ...` | Re-run the installer. Until then the panel restarts Chisel on every authfile change |
334
334
  | Authfile or key unreadable | `permission denied` on `chisel-users` or `chisel-server.key` | Both must be `0640 lamaste:lamaste-chisel` and the unit `Group=lamaste-chisel`; restart the panel, which re-applies the authfile's. If the group, the unit or the key's ownership is wrong, re-run the installer in redeploy mode |
335
335
  | Stopped by the panel | (panel log) `Chisel stopped: ...`; unit disabled, `chisel-failed-closed` present | Reconciliation failed closed; see [Tunnel Client Cannot Connect](#tunnel-client-cannot-connect), Cause 1 |
@@ -343,7 +343,7 @@ ls -la /usr/local/bin/authelia
343
343
  | --------------------------- | --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
344
344
  | Invalid `configuration.yml` | `configuration: error` | Check YAML syntax with `authelia validate-configuration --config /etc/authelia/configuration.yml` |
345
345
  | Missing `users.yml` | `cannot open file` | Create an initial users file (see [Config Files](config-files.md)) |
346
- | Binary missing | `not found` | Re-run the installer (`npx @lamalibre/create-lamaste@4.3.0 --yes`); it installs the pinned release |
346
+ | Binary missing | `not found` | Re-run the installer (`npx @lamalibre/create-lamaste@4.4.0 --yes`); it installs the pinned release |
347
347
  | Wrong permissions | `permission denied` | Authelia runs as `lamaste-authelia`: `/etc/authelia` must be `lamaste:lamaste-authelia 2770`, `configuration.yml` `0640`, `users.yml` `0660`, `db.sqlite3` owned by `lamaste-authelia`. Re-run the installer to re-apply (a root-owned `/etc/authelia` from an older version is converted), or see [Config Files](config-files.md#file-permissions-table) |
348
348
  | Database newer than binary | storage schema version error at startup | A newer Authelia ran against this database and was replaced by an older one; the installer never downgrades an installed Authelia, so reinstall that newer release by hand |
349
349
 
@@ -516,14 +516,14 @@ sudo systemctl restart authelia
516
516
 
517
517
  ## Onboarding Fails: "Chisel is not installed" / "Authelia is not installed"
518
518
 
519
- **Symptom:** The **Starting Chisel** or **Configuring Authelia** provisioning task fails with "Chisel is not installed. Run `npx @lamalibre/create-lamaste@4.3.0` on the server to repair the installation." (or the same for Authelia).
519
+ **Symptom:** The **Starting Chisel** or **Configuring Authelia** provisioning task fails with "Chisel is not installed. Run `npx @lamalibre/create-lamaste@4.4.0` on the server to repair the installation." (or the same for Authelia).
520
520
 
521
521
  **Cause:** Onboarding downloads nothing: the installer installs both binaries (pinned releases), their systemd units and the `lamaste-authelia` account. The binary at `/usr/local/bin/chisel` or `/usr/local/bin/authelia` is missing — the installer was interrupted, or the file was removed.
522
522
 
523
523
  **Fix:** Re-run the installer on the server, then start provisioning again from the wizard:
524
524
 
525
525
  ```bash
526
- npx @lamalibre/create-lamaste@4.3.0 --yes
526
+ npx @lamalibre/create-lamaste@4.4.0 --yes
527
527
  ```
528
528
 
529
529
  If provisioning then fails writing Authelia's configuration with `/etc/authelia is not writable by the panel — run create-lamaste to repair the installation`, the directory's ownership is wrong; the same command repairs it.
@@ -538,7 +538,7 @@ If provisioning then fails writing Authelia's configuration with `/etc/authelia
538
538
 
539
539
  **Fix:**
540
540
 
541
- 1. Re-run the installer so the helper matches the panel: `npx @lamalibre/create-lamaste@4.3.0 --yes`
541
+ 1. Re-run the installer so the helper matches the panel: `npx @lamalibre/create-lamaste@4.4.0 --yes`
542
542
  2. If it persists on a current install, it is a bug: the vhost generators (`packages/server/daemon/src/lib/nginx.js`) and the allow-list (`packages/provisioners/server/scripts/lamaste-priv`) must change together — `npm test` checks every generated vhost against the allow-list. Do not work around it by editing files in `/etc/nginx` by hand.
543
543
 
544
544
  `sudo: a password is required` for `lamaste-priv` means the helper or the sudoers file is missing or outdated: re-run the installer.
@@ -621,7 +621,7 @@ df -h /
621
621
 
622
622
  **Cause 3: The web root is not writable by the panel (`EACCES`).**
623
623
 
624
- The panel writes `/var/www/lamaste` itself: it must be `lamaste:www-data`, directories `2750`, files `0640`. An install from before this layout had it owned by `www-data`. Re-run the installer (`npx @lamalibre/create-lamaste@4.3.0 --yes`); the redeploy converts the tree.
624
+ The panel writes `/var/www/lamaste` itself: it must be `lamaste:www-data`, directories `2750`, files `0640`. An install from before this layout had it owned by `www-data`. Re-run the installer (`npx @lamalibre/create-lamaste@4.4.0 --yes`); the redeploy converts the tree.
625
625
 
626
626
  ---
627
627