@lamalibre/create-lamaste 4.3.1 → 4.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +2 -2
- package/src/lib/service-config.js +6 -0
- package/vendor/docs/00-introduction/how-it-works.md +2 -2
- package/vendor/docs/00-introduction/quickstart.md +5 -5
- package/vendor/docs/00-introduction/what-is-lamaste.md +5 -5
- package/vendor/docs/01-concepts/certificates.md +3 -3
- package/vendor/docs/01-concepts/mtls.md +2 -2
- package/vendor/docs/01-concepts/security-model.md +38 -1
- package/vendor/docs/01-concepts/tickets.md +2 -2
- package/vendor/docs/01-concepts/tunneling.md +4 -4
- package/vendor/docs/02-guides/agent-setup.md +6 -6
- package/vendor/docs/02-guides/certificate-management.md +2 -2
- package/vendor/docs/02-guides/cloud-provisioning.md +3 -3
- package/vendor/docs/02-guides/desktop-app-setup.md +11 -11
- package/vendor/docs/02-guides/installation.md +3 -3
- package/vendor/docs/02-guides/onboarding.md +2 -2
- package/vendor/docs/02-guides/standalone-plugin-with-tickets.md +2 -2
- package/vendor/docs/03-architecture/installer-flow.md +2 -2
- package/vendor/docs/03-architecture/installer.md +4 -4
- package/vendor/docs/03-architecture/management-flow.md +1 -1
- package/vendor/docs/03-architecture/overview.md +5 -5
- package/vendor/docs/03-architecture/panel-client.md +7 -7
- package/vendor/docs/03-architecture/panel-server.md +2 -2
- package/vendor/docs/03-architecture/state-management.md +2 -2
- package/vendor/docs/03-architecture/system-overview.md +1 -1
- package/vendor/docs/04-api-reference/agent-hosted-plugins.md +393 -33
- package/vendor/docs/04-api-reference/app-host.md +87 -38
- package/vendor/docs/04-api-reference/audit-and-notifications.md +10 -10
- package/vendor/docs/04-api-reference/certificates.md +22 -19
- package/vendor/docs/04-api-reference/lifecycle-hooks.md +33 -11
- package/vendor/docs/04-api-reference/onboarding.md +1 -1
- package/vendor/docs/04-api-reference/overview.md +137 -135
- package/vendor/docs/04-api-reference/tunnels.md +14 -10
- package/vendor/docs/05-operations/backup-and-restore.md +2 -1
- package/vendor/docs/05-operations/uninstalling.md +1 -1
- package/vendor/docs/05-operations/upgrades.md +6 -6
- package/vendor/docs/06-reference/config-files.md +89 -84
- package/vendor/docs/06-reference/glossary.md +3 -3
- package/vendor/docs/06-reference/installer-flags.md +13 -13
- package/vendor/docs/06-reference/ports-and-services.md +1 -1
- package/vendor/docs/06-reference/troubleshooting.md +8 -8
- package/vendor/docs/gatekeeper-design.md +8 -8
- package/vendor/docs/identity-directory-design.md +2 -2
- package/vendor/docs/package.json +1 -1
- package/vendor/docs/todo/lib-cli-desktop-refactor.md +27 -27
- package/vendor/gatekeeper/package.json +2 -2
- package/vendor/server/bin/lamaste-server.js +4 -1
- package/vendor/server/package.json +4 -3
- package/vendor/server/src/commands/plugin-settings.js +541 -0
- package/vendor/server/src/commands/plugins.js +94 -27
- package/vendor/server/src/panel-api.js +36 -4
- package/vendor/server/src/plugin-approval.js +78 -0
- package/vendor/server/src/plugin-settings.js +699 -0
- package/vendor/server-ui/dist/assets/index-25wo_8av.css +1 -0
- package/vendor/server-ui/dist/assets/index-CESyyK8V.js +84 -0
- package/vendor/server-ui/dist/index.html +2 -2
- package/vendor/serverd/package.json +2 -2
- package/vendor/serverd/src/index.js +9 -0
- package/vendor/serverd/src/lib/agent-presence.js +106 -0
- package/vendor/serverd/src/lib/hook-pipelines.js +20 -4
- package/vendor/serverd/src/lib/migrations/state/0012_plugin_settings_and_presence.sql +62 -0
- package/vendor/serverd/src/lib/mtls.js +44 -4
- package/vendor/serverd/src/lib/plugin-hooks.js +120 -20
- package/vendor/serverd/src/lib/plugin-hosting.js +35 -14
- package/vendor/serverd/src/lib/plugin-lifecycle.js +267 -83
- package/vendor/serverd/src/lib/plugin-settings.js +1101 -0
- package/vendor/serverd/src/lib/plugins.js +73 -22
- package/vendor/serverd/src/lib/tunnel-hooks.js +11 -0
- package/vendor/serverd/src/routes/management/plugins.js +166 -19
- package/vendor/serverd/src/routes/management/tunnels.js +21 -1
- package/vendor/server-ui/dist/assets/index-BTlBt_cD.js +0 -84
- package/vendor/server-ui/dist/assets/index-Bc5NCMSv.css +0 -1
|
@@ -4,71 +4,72 @@
|
|
|
4
4
|
|
|
5
5
|
## File Overview
|
|
6
6
|
|
|
7
|
-
| File | Format | Owner | Mode | Purpose
|
|
8
|
-
| ------------------------------------------------------------------ | ---------- | ------------------------ | ---- |
|
|
9
|
-
| `/etc/lamalibre/lamaste/panel.json` | JSON | lamaste:lamaste | 0600 | Panel server configuration
|
|
10
|
-
| `/etc/lamalibre/lamaste/tunnels.json` | JSON | lamaste:lamaste | 0600 | Tunnel definitions
|
|
11
|
-
| `/etc/lamalibre/lamaste/sites.json` | JSON | lamaste:lamaste | 0600 | Static site definitions
|
|
12
|
-
| `/etc/lamalibre/lamaste/chisel-credentials.json` | JSON | lamaste:lamaste | 0600 | Per-agent Chisel credentials (source of truth for the authfile)
|
|
13
|
-
| `/etc/lamalibre/lamaste/chisel-users` | JSON | lamaste:lamaste-chisel | 0640 | Chisel `--authfile`: per-agent credentials and port grants (rendered)
|
|
14
|
-
| `/etc/lamalibre/lamaste/chisel-sentinel` | text | lamaste:lamaste | 0600 | Password of the `lamaste-no-grants` sentinel user
|
|
15
|
-
| `/etc/lamalibre/lamaste/chisel-server.key` | PEM | lamaste:lamaste-chisel | 0640 | Chisel SSH host key (`--keyfile`), generated by the panel at onboarding
|
|
16
|
-
| `/etc/authelia/configuration.yml` | YAML | lamaste:lamaste-authelia | 0640 | Authelia server configuration
|
|
17
|
-
| `/etc/authelia/users.yml` | YAML | lamaste:lamaste-authelia | 0660 | User database (Authelia rewrites it on a password change)
|
|
18
|
-
| `/etc/authelia/.secrets.json` | JSON | lamaste:lamaste-authelia | 0600 | Authelia secrets (panel only)
|
|
19
|
-
| `/etc/authelia/oidc-issuer.pem` | PEM | lamaste-authelia | 0600 | RSA-4096 key Authelia signs OIDC tokens with, written by `create-lamaste`; the panel cannot read it
|
|
20
|
-
| `/etc/lamalibre/lamaste/registry-credential.json` | JSON | lamaste:lamaste | 0600 | The panel's registry (Feria) credential: a pasted token, or the `lamaste-server` OIDC client
|
|
21
|
-
| `/etc/lamalibre/lamaste/oidc-clients.json` | JSON | lamaste:lamaste | 0600 | Plaintext secrets (and pbkdf2 salts) of confidential OIDC clients
|
|
22
|
-
| `/etc/lamalibre/lamaste/relay-signing-key.json` | JSON | lamaste:lamaste | 0600 | Ed25519 key relay assertions (panel, Gatekeeper) and agents' app jobs (panel) are signed with
|
|
23
|
-
| `/etc/lamalibre/lamaste/push-install-config.json` | JSON | lamaste:lamaste | 0600 | Push install: the switch, the policies, the default policy
|
|
24
|
-
| `/etc/lamalibre/lamaste/push-install-sessions.json` | JSON | lamaste:lamaste | 0600 | Push install log (last 500 pushes)
|
|
25
|
-
| `/etc/lamalibre/lamaste/ticket-scopes.json` | JSON | lamaste:lamaste | 0600 | Ticket scope registry
|
|
26
|
-
| `/etc/lamalibre/lamaste/tickets.json` | JSON | lamaste:lamaste | 0600 | Ticket and session store
|
|
27
|
-
| `/etc/lamalibre/lamaste/invitations.json` | JSON | lamaste:lamaste | 0600 | Pending user invitations
|
|
28
|
-
| `/etc/lamalibre/lamaste/plugins.json` | JSON | lamaste:lamaste | 0600 | Plugin registry (before 4.2; the registry is now in `state.db`)
|
|
29
|
-
| `/etc/lamalibre/lamaste/state.db` | SQLite | lamaste:lamaste | 0600 | Plugins (with their hooks), agents, tickets, enrollment tokens, the audit log, notifications, relay hook approvals, plugin operations, agent jobs |
|
|
30
|
-
| `/etc/lamalibre/lamaste/plugin-hostings.json` | JSON | lamaste:lamaste | 0600 | Hostings of agent-hosted plugins: agent, port, phase, installation secrets, health
|
|
31
|
-
| `/opt/lamalibre/lamaste/hooks/<route>/` | directory | root:root | 0755 | A plugin's approved relay hook module (`<sha256>.mjs`, 0644) and `runner.env`, written by `lamaste-priv`
|
|
32
|
-
| `/etc/lamalibre/lamaste/storage-config.json` | JSON | lamaste:lamaste | 0600 | Storage server registry and plugin bindings (credentials AES-256-GCM encrypted)
|
|
33
|
-
| `/etc/lamalibre/lamaste/storage-master.key` | Binary | lamaste:lamaste | 0600 | 32-byte master key for storage credential encryption
|
|
34
|
-
| `/etc/lamalibre/lamaste/groups.json` | JSON | lamaste:lamaste | 0600 | Lamaste group definitions and membership
|
|
35
|
-
| `/etc/lamalibre/lamaste/access-grants.json` | JSON | lamaste:lamaste | 0600 | Generic access grants (principal → resource)
|
|
36
|
-
| `/etc/lamalibre/lamaste/gatekeeper.json` | JSON | lamaste:lamaste | 0600 | Gatekeeper settings (cache TTL, admin contact, logging)
|
|
37
|
-
| `/etc/lamalibre/lamaste/access-request-log.json` | JSON | lamaste:lamaste | 0600 | Optional denied access log
|
|
38
|
-
| `/etc/lamalibre/lamaste/pki/enrollment-tokens.json` | JSON | lamaste:lamaste | 0600 | One-time enrollment tokens for hardware-bound enrollment
|
|
39
|
-
| `/etc/lamalibre/lamaste/pki/revoked.json` | JSON | lamaste:lamaste | 0600 | Revoked certificate serial numbers
|
|
40
|
-
| `/etc/lamalibre/lamaste/pki/agents/registry.json` | JSON | lamaste:lamaste | 0600 | Agent certificate metadata
|
|
41
|
-
| `/etc/nginx/sites-available/lamalibre-lamaste-*` | nginx conf | root:root | 0644 | Vhost configurations (the panel's are installed by `lamaste-priv`)
|
|
42
|
-
| `/etc/nginx/snippets/lamalibre-lamaste-mtls.conf` | nginx conf | root:root | 0644 | mTLS snippet
|
|
43
|
-
| `/etc/nginx/snippets/lamalibre-lamaste-authz-cache.conf` | nginx conf | root:root | 0644 | Gatekeeper proxy_cache zone
|
|
44
|
-
| `/etc/systemd/system/lamalibre-lamaste-gatekeeper.service` | systemd | root:root | 0644 | Gatekeeper systemd unit
|
|
45
|
-
| `/etc/systemd/system/chisel.service` | systemd | root:root | 0644 | Chisel unit, written by `create-lamaste`
|
|
46
|
-
| `/etc/systemd/system/authelia.service` | systemd | root:root | 0644 | Authelia unit, written by `create-lamaste`
|
|
47
|
-
| `/etc/systemd/system/lamalibre-lamaste-hooks@.socket`, `@.service` | systemd | root:root | 0644 | Relay hook runner (one instance per plugin with relay hooks), written by `create-lamaste`
|
|
48
|
-
| `~/.lamalibre/lamaste/servers.json` | JSON | user | 0600 | Desktop app server registry
|
|
49
|
-
| `~/.lamalibre/lamaste/agents.json` | JSON | user | 0600 | Multi-agent registry
|
|
50
|
-
| `~/.lamalibre/lamaste/agentd.token` | JSON | user | 0600 | Bearer token of lamaste-agentd's owner (the desktop app, scripts run as the user)
|
|
51
|
-
| `~/.lamalibre/lamaste/agents/<label>/config.json` | JSON | user | 0600 | Per-agent configuration
|
|
52
|
-
| `~/.lamalibre/lamaste/agents/<label>/client.p12` | PKCS#12 | user | 0600 | Per-agent mTLS certificate
|
|
53
|
-
| `~/.lamalibre/lamaste/agents/<label>/ca.crt` | PEM | user | 0644 | Per-agent CA certificate
|
|
54
|
-
| `~/.lamalibre/lamaste/agents/<label>/chisel.json` | JSON | user | 0600 | Per-agent Chisel credential (source of truth for the service)
|
|
55
|
-
| `~/.lamalibre/lamaste/agents/<label>/chisel.env` | env file | user | 0600 | Linux only: `AUTH=` for the systemd unit's `EnvironmentFile=`
|
|
56
|
-
| `~/.lamalibre/lamaste/agents/<label>/` | directory | user | 0700 | Per-agent data directory
|
|
57
|
-
| `~/.lamalibre/lamaste/agents/<label>/sync-state.json` | JSON | user | 0600 | Outcome of the last `lamaste-agent sync`
|
|
58
|
-
| `~/.lamalibre/lamaste/agents/<label>/app-plugins/<route>.json` | JSON | user | 0600 | Port and installation secret of a plugin hosted on this agent
|
|
59
|
-
| `~/.lamalibre/lamaste/agents/<label>/app-plugin-tunnel-state.json` | JSON | user | 0600 | The tunnel state last delivered to each hosted plugin's agent half
|
|
60
|
-
| `~/.lamalibre/lamaste/agents/<label>/apphost-state.json` | JSON | user | 0600 | The agent halves the app host helper installed for this agent
|
|
61
|
-
| `~/.lamalibre/lamaste/agents/<label>/host-facts.json` | JSON | user | 0600 | What the agent last reported about its host, and the helper's last answer
|
|
62
|
-
| `~/.lamalibre/lamaste/agents/<label>/app-job-results.json` | JSON | user | 0600 | App job results the relay has not taken yet
|
|
63
|
-
| `~/.lamalibre/lamaste/agents/<label>/logs/` | directory | user | 0700 | Per-agent Chisel and sync log files
|
|
64
|
-
| `~/.lamalibre/lamaste/agent.json` | JSON | user | 0600 | Legacy single-server config
|
|
65
|
-
| `/usr/local/sbin/lamaste-apphost` | Node.js | root:root | 0755 | Agent machine: the app host helper — see [Agent machine: the app host](#agent-machine-the-app-host)
|
|
66
|
-
| `/etc/sudoers.d/lamaste-apphost` | sudoers | root:root | 0440 | Agent machine: lets the agent's user run the helper
|
|
67
|
-
| `/etc/lamalibre/apphost/relays/<label>.json` | JSON | root:root | 0644 | Agent machine: the relay key pinned for agent `<label>`
|
|
68
|
-
| `/opt/lamalibre/apps/<route>/` | directory | root:root | 0755 | Agent machine: an agent half's installed versions
|
|
69
|
-
| `/var/lib/lamalibre/apps/<route>/` | directory | lamaste-app-\<route\> | 0700 | Agent machine: an agent half's data
|
|
70
|
-
| `/etc/lamalibre/apps/<route>/plugin-config.json` | JSON | lamaste-app-\<route\> | 0600 | Agent machine: an agent half's port and installation secret
|
|
71
|
-
| `/etc/systemd/system/lamalibre-app-<route>.service` | systemd | root:root | 0644 | Agent machine: an agent half's unit
|
|
7
|
+
| File | Format | Owner | Mode | Purpose |
|
|
8
|
+
| ------------------------------------------------------------------ | ---------- | ------------------------ | ---- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
|
9
|
+
| `/etc/lamalibre/lamaste/panel.json` | JSON | lamaste:lamaste | 0600 | Panel server configuration |
|
|
10
|
+
| `/etc/lamalibre/lamaste/tunnels.json` | JSON | lamaste:lamaste | 0600 | Tunnel definitions |
|
|
11
|
+
| `/etc/lamalibre/lamaste/sites.json` | JSON | lamaste:lamaste | 0600 | Static site definitions |
|
|
12
|
+
| `/etc/lamalibre/lamaste/chisel-credentials.json` | JSON | lamaste:lamaste | 0600 | Per-agent Chisel credentials (source of truth for the authfile) |
|
|
13
|
+
| `/etc/lamalibre/lamaste/chisel-users` | JSON | lamaste:lamaste-chisel | 0640 | Chisel `--authfile`: per-agent credentials and port grants (rendered) |
|
|
14
|
+
| `/etc/lamalibre/lamaste/chisel-sentinel` | text | lamaste:lamaste | 0600 | Password of the `lamaste-no-grants` sentinel user |
|
|
15
|
+
| `/etc/lamalibre/lamaste/chisel-server.key` | PEM | lamaste:lamaste-chisel | 0640 | Chisel SSH host key (`--keyfile`), generated by the panel at onboarding |
|
|
16
|
+
| `/etc/authelia/configuration.yml` | YAML | lamaste:lamaste-authelia | 0640 | Authelia server configuration |
|
|
17
|
+
| `/etc/authelia/users.yml` | YAML | lamaste:lamaste-authelia | 0660 | User database (Authelia rewrites it on a password change) |
|
|
18
|
+
| `/etc/authelia/.secrets.json` | JSON | lamaste:lamaste-authelia | 0600 | Authelia secrets (panel only) |
|
|
19
|
+
| `/etc/authelia/oidc-issuer.pem` | PEM | lamaste-authelia | 0600 | RSA-4096 key Authelia signs OIDC tokens with, written by `create-lamaste`; the panel cannot read it |
|
|
20
|
+
| `/etc/lamalibre/lamaste/registry-credential.json` | JSON | lamaste:lamaste | 0600 | The panel's registry (Feria) credential: a pasted token, or the `lamaste-server` OIDC client |
|
|
21
|
+
| `/etc/lamalibre/lamaste/oidc-clients.json` | JSON | lamaste:lamaste | 0600 | Plaintext secrets (and pbkdf2 salts) of confidential OIDC clients |
|
|
22
|
+
| `/etc/lamalibre/lamaste/relay-signing-key.json` | JSON | lamaste:lamaste | 0600 | Ed25519 key relay assertions (panel, Gatekeeper) and agents' app jobs (panel) are signed with |
|
|
23
|
+
| `/etc/lamalibre/lamaste/push-install-config.json` | JSON | lamaste:lamaste | 0600 | Push install: the switch, the policies, the default policy |
|
|
24
|
+
| `/etc/lamalibre/lamaste/push-install-sessions.json` | JSON | lamaste:lamaste | 0600 | Push install log (last 500 pushes) |
|
|
25
|
+
| `/etc/lamalibre/lamaste/ticket-scopes.json` | JSON | lamaste:lamaste | 0600 | Ticket scope registry |
|
|
26
|
+
| `/etc/lamalibre/lamaste/tickets.json` | JSON | lamaste:lamaste | 0600 | Ticket and session store |
|
|
27
|
+
| `/etc/lamalibre/lamaste/invitations.json` | JSON | lamaste:lamaste | 0600 | Pending user invitations |
|
|
28
|
+
| `/etc/lamalibre/lamaste/plugins.json` | JSON | lamaste:lamaste | 0600 | Plugin registry (before 4.2; the registry is now in `state.db`) |
|
|
29
|
+
| `/etc/lamalibre/lamaste/state.db` | SQLite | lamaste:lamaste | 0600 | Plugins (with their hooks), agents, tickets, enrollment tokens, the audit log, notifications, relay hook approvals, plugin operations, agent jobs, the cache of agent-hosted plugins' settings (never a secret), each agent's last contact |
|
|
30
|
+
| `/etc/lamalibre/lamaste/plugin-hostings.json` | JSON | lamaste:lamaste | 0600 | Hostings of agent-hosted plugins: agent, port, phase, installation secrets, health |
|
|
31
|
+
| `/opt/lamalibre/lamaste/hooks/<route>/` | directory | root:root | 0755 | A plugin's approved relay hook module (`<sha256>.mjs`, 0644) and `runner.env`, written by `lamaste-priv` |
|
|
32
|
+
| `/etc/lamalibre/lamaste/storage-config.json` | JSON | lamaste:lamaste | 0600 | Storage server registry and plugin bindings (credentials AES-256-GCM encrypted) |
|
|
33
|
+
| `/etc/lamalibre/lamaste/storage-master.key` | Binary | lamaste:lamaste | 0600 | 32-byte master key for storage credential encryption |
|
|
34
|
+
| `/etc/lamalibre/lamaste/groups.json` | JSON | lamaste:lamaste | 0600 | Lamaste group definitions and membership |
|
|
35
|
+
| `/etc/lamalibre/lamaste/access-grants.json` | JSON | lamaste:lamaste | 0600 | Generic access grants (principal → resource) |
|
|
36
|
+
| `/etc/lamalibre/lamaste/gatekeeper.json` | JSON | lamaste:lamaste | 0600 | Gatekeeper settings (cache TTL, admin contact, logging) |
|
|
37
|
+
| `/etc/lamalibre/lamaste/access-request-log.json` | JSON | lamaste:lamaste | 0600 | Optional denied access log |
|
|
38
|
+
| `/etc/lamalibre/lamaste/pki/enrollment-tokens.json` | JSON | lamaste:lamaste | 0600 | One-time enrollment tokens for hardware-bound enrollment |
|
|
39
|
+
| `/etc/lamalibre/lamaste/pki/revoked.json` | JSON | lamaste:lamaste | 0600 | Revoked certificate serial numbers |
|
|
40
|
+
| `/etc/lamalibre/lamaste/pki/agents/registry.json` | JSON | lamaste:lamaste | 0600 | Agent certificate metadata |
|
|
41
|
+
| `/etc/nginx/sites-available/lamalibre-lamaste-*` | nginx conf | root:root | 0644 | Vhost configurations (the panel's are installed by `lamaste-priv`) |
|
|
42
|
+
| `/etc/nginx/snippets/lamalibre-lamaste-mtls.conf` | nginx conf | root:root | 0644 | mTLS snippet |
|
|
43
|
+
| `/etc/nginx/snippets/lamalibre-lamaste-authz-cache.conf` | nginx conf | root:root | 0644 | Gatekeeper proxy_cache zone |
|
|
44
|
+
| `/etc/systemd/system/lamalibre-lamaste-gatekeeper.service` | systemd | root:root | 0644 | Gatekeeper systemd unit |
|
|
45
|
+
| `/etc/systemd/system/chisel.service` | systemd | root:root | 0644 | Chisel unit, written by `create-lamaste` |
|
|
46
|
+
| `/etc/systemd/system/authelia.service` | systemd | root:root | 0644 | Authelia unit, written by `create-lamaste` |
|
|
47
|
+
| `/etc/systemd/system/lamalibre-lamaste-hooks@.socket`, `@.service` | systemd | root:root | 0644 | Relay hook runner (one instance per plugin with relay hooks), written by `create-lamaste` |
|
|
48
|
+
| `~/.lamalibre/lamaste/servers.json` | JSON | user | 0600 | Desktop app server registry |
|
|
49
|
+
| `~/.lamalibre/lamaste/agents.json` | JSON | user | 0600 | Multi-agent registry |
|
|
50
|
+
| `~/.lamalibre/lamaste/agentd.token` | JSON | user | 0600 | Bearer token of lamaste-agentd's owner (the desktop app, scripts run as the user) |
|
|
51
|
+
| `~/.lamalibre/lamaste/agents/<label>/config.json` | JSON | user | 0600 | Per-agent configuration |
|
|
52
|
+
| `~/.lamalibre/lamaste/agents/<label>/client.p12` | PKCS#12 | user | 0600 | Per-agent mTLS certificate |
|
|
53
|
+
| `~/.lamalibre/lamaste/agents/<label>/ca.crt` | PEM | user | 0644 | Per-agent CA certificate |
|
|
54
|
+
| `~/.lamalibre/lamaste/agents/<label>/chisel.json` | JSON | user | 0600 | Per-agent Chisel credential (source of truth for the service) |
|
|
55
|
+
| `~/.lamalibre/lamaste/agents/<label>/chisel.env` | env file | user | 0600 | Linux only: `AUTH=` for the systemd unit's `EnvironmentFile=` |
|
|
56
|
+
| `~/.lamalibre/lamaste/agents/<label>/` | directory | user | 0700 | Per-agent data directory |
|
|
57
|
+
| `~/.lamalibre/lamaste/agents/<label>/sync-state.json` | JSON | user | 0600 | Outcome of the last `lamaste-agent sync` |
|
|
58
|
+
| `~/.lamalibre/lamaste/agents/<label>/app-plugins/<route>.json` | JSON | user | 0600 | Port and installation secret of a plugin hosted on this agent |
|
|
59
|
+
| `~/.lamalibre/lamaste/agents/<label>/app-plugin-tunnel-state.json` | JSON | user | 0600 | The tunnel state last delivered to each hosted plugin's agent half |
|
|
60
|
+
| `~/.lamalibre/lamaste/agents/<label>/apphost-state.json` | JSON | user | 0600 | The agent halves the app host helper installed for this agent |
|
|
61
|
+
| `~/.lamalibre/lamaste/agents/<label>/host-facts.json` | JSON | user | 0600 | What the agent last reported about its host, and the helper's last answer |
|
|
62
|
+
| `~/.lamalibre/lamaste/agents/<label>/app-job-results.json` | JSON | user | 0600 | App job results the relay has not taken yet |
|
|
63
|
+
| `~/.lamalibre/lamaste/agents/<label>/logs/` | directory | user | 0700 | Per-agent Chisel and sync log files |
|
|
64
|
+
| `~/.lamalibre/lamaste/agent.json` | JSON | user | 0600 | Legacy single-server config |
|
|
65
|
+
| `/usr/local/sbin/lamaste-apphost` | Node.js | root:root | 0755 | Agent machine: the app host helper — see [Agent machine: the app host](#agent-machine-the-app-host) |
|
|
66
|
+
| `/etc/sudoers.d/lamaste-apphost` | sudoers | root:root | 0440 | Agent machine: lets the agent's user run the helper |
|
|
67
|
+
| `/etc/lamalibre/apphost/relays/<label>.json` | JSON | root:root | 0644 | Agent machine: the relay key pinned for agent `<label>` |
|
|
68
|
+
| `/opt/lamalibre/apps/<route>/` | directory | root:root | 0755 | Agent machine: an agent half's installed versions |
|
|
69
|
+
| `/var/lib/lamalibre/apps/<route>/` | directory | lamaste-app-\<route\> | 0700 | Agent machine: an agent half's data |
|
|
70
|
+
| `/etc/lamalibre/apps/<route>/plugin-config.json` | JSON | lamaste-app-\<route\> | 0600 | Agent machine: an agent half's port and installation secret |
|
|
71
|
+
| `/etc/systemd/system/lamalibre-app-<route>.service` | systemd | root:root | 0644 | Agent machine: an agent half's unit |
|
|
72
|
+
| `/etc/systemd/system/lamalibre-app-<route>.socket` | systemd | root:root | 0644 | Agent machine: the socket unit holding an agent half's port |
|
|
72
73
|
|
|
73
74
|
---
|
|
74
75
|
|
|
@@ -915,7 +916,7 @@ The directory itself is mode 0700 (re-applied on every sync).
|
|
|
915
916
|
- `plugins/` — per-plugin data directories
|
|
916
917
|
- `app-plugins/<route>.json` — the port and installation secret of a plugin hosted on this agent (mode 0600): `{ plugin, port, secret, issuedAt, previousSecret?, previousIssuedAt?, fetchedAt, acknowledged }`
|
|
917
918
|
- `apphost-state.json` — the agent halves the app host helper installed for this agent (mode 0600): `{ "apps": { "<route>": { "version": "1.0.0", "updatedAt": "…" } } }`. Written by the sync's app jobs; read by converge, which hands a fetched plugin config to the service of a route listed here before acknowledging it. When it cannot be read the sync rebuilds it from the helper's owner records naming this label
|
|
918
|
-
- `host-facts.json` — what was last reported as host facts and the helper's last answer (mode 0600): `{ "reported": { "hash", "at" } | null, "apphost": { "helper": "<dev:ino:size:mtime>", "facts": { "version", "node" } | null, "at" } | null }`. Facts are reported when their hash changes or a day passed; the helper is asked again when its file changes or a day passed
|
|
919
|
+
- `host-facts.json` — what was last reported as host facts and the helper's last answer (mode 0600): `{ "reported": { "hash", "at" } | null, "apphost": { "helper": "<dev:ino:size:mtime>", "facts": { "version", "node" } | null, "at" } | null }`. Facts are reported when their hash changes, when the relay's agent-config `hostFactsHash` (the hash of the facts it stores, `null` for none) is not theirs, or a day passed; the helper is asked again when its file changes or a day passed
|
|
919
920
|
- `app-job-results.json` — results of app jobs the relay has not taken yet (mode 0600): `{ "<jobId>": { "result", "deadlineAt" } }` — a signed job runs once, so a report that failed is made again from here, until the job's deadline
|
|
920
921
|
|
|
921
922
|
An install job packs the agent package in `~/.lamalibre/lamaste/tmp/agent/apphost-*/` (0700, with a throw-away npm userconfig holding the brokered registry token) and deletes it afterwards.
|
|
@@ -925,7 +926,7 @@ Service files use per-agent names:
|
|
|
925
926
|
- macOS: `com.lamalibre.lamaste.chisel-<label>` (plist label), `~/Library/LaunchAgents/com.lamalibre.lamaste.chisel-<label>.plist` — mode 0600, because it carries `AUTH` in `EnvironmentVariables`
|
|
926
927
|
- Linux: `lamalibre-lamaste-chisel-<label>` (unit name), `~/.config/systemd/user/lamalibre-lamaste-chisel-<label>.service` — a systemd **user** unit with `EnvironmentFile=` pointing at `chisel.env`; enable lingering (`sudo loginctl enable-linger <user>`) for it to start at boot without a login
|
|
927
928
|
|
|
928
|
-
Both run `chisel client --max-retry-interval 30s https://tunnel.<domain>:443 R:127.0.0.1:<port>:127.0.0.1:<port> ...` with TLS verification and no credential in argv. They are generated by `@lamalibre/lamaste@4.
|
|
929
|
+
Both run `chisel client --max-retry-interval 30s https://tunnel.<domain>:443 R:127.0.0.1:<port>:127.0.0.1:<port> ...` with TLS verification and no credential in argv. They are generated by `@lamalibre/lamaste@4.4.0/agent` (`chisel-service.ts`) and rewritten by `lamaste-agent setup`, `update` and `sync` — do not edit them by hand. An agent carrying no tunnels has its service unloaded (Chisel cannot run without a remote).
|
|
929
930
|
|
|
930
931
|
The sync timer, which runs `<node> <installed lamaste-agent> sync --label <label> --quiet` (`<node>` is a stable path such as `/opt/homebrew/bin/node` when one on `PATH` resolves to the running binary, so a Node.js upgrade does not break it):
|
|
931
932
|
|
|
@@ -951,26 +952,29 @@ Legacy single-server configuration. Automatically migrated to the multi-agent re
|
|
|
951
952
|
|
|
952
953
|
On a Linux agent where the operator ran `sudo lamaste-agent apphost enable`, the root helper `lamaste-apphost` installs the agent halves of the plugins the panel hosts there ([App Host](../04-api-reference/app-host.md)). Every path below is derived from a validated route or agent label; root writes them atomically (temp file, `fsync`, rename) and refuses to use one that is not what it expects — a directory another user can write, a link where a file belongs.
|
|
953
954
|
|
|
954
|
-
| Path | Owner | Mode | Contents
|
|
955
|
-
| --------------------------------------------------- | ---------------------------- | --------------------- |
|
|
956
|
-
| `/usr/local/sbin/lamaste-apphost` | root:root | 0755 | The helper — copied by `enable` from a root-owned `lamaste-agent` install
|
|
957
|
-
| `/etc/sudoers.d/lamaste-apphost` | root:root | 0440 | `<user> ALL=(root) NOPASSWD: /usr/local/sbin/lamaste-apphost`, with `env_reset`, `!setenv` and Node.js variables deleted; checked with `visudo -c` before it is renamed into place. None when the agent runs as root
|
|
958
|
-
| `/etc/lamalibre/apphost/relays/<label>.json` | root:root | 0644 (dirs 0755) | The relay key pinned for agent `<label>`: `{ v, label, agent, kid, publicKey, panelUrl, pinnedAt }` — public material
|
|
959
|
-
| `/opt/lamalibre/apps/<route>/<version>/` | root:root | dirs 0755, files 0644 | The package as published (`package/`) and `apphost.json`, the spec it was installed with
|
|
960
|
-
| `/opt/lamalibre/apps/<route>/current`, `previous` | root:root | symlinks | The running version and the one before it; other versions are deleted
|
|
961
|
-
| `/opt/lamalibre/apps/.stage-<hex>-<route>/` | root:root | 0700 | Unpacking while an install runs
|
|
962
|
-
| `/var/lib/lamalibre/apps/<route>/` | the agent half's account | 0700 | The agent half's data (`LAMASTE_APP_DATA_DIR`) — kept on removal, deleted by a purge
|
|
963
|
-
| `/var/lib/lamalibre/apps
|
|
964
|
-
| `/var/lib/lamalibre/apps
|
|
965
|
-
| `/var/lib/lamalibre/apps/.
|
|
966
|
-
| `/
|
|
967
|
-
| `/
|
|
968
|
-
| `/etc/
|
|
969
|
-
| `/
|
|
955
|
+
| Path | Owner | Mode | Contents |
|
|
956
|
+
| --------------------------------------------------- | ---------------------------- | --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
957
|
+
| `/usr/local/sbin/lamaste-apphost` | root:root | 0755 | The helper — copied by `enable` from a root-owned `lamaste-agent` install |
|
|
958
|
+
| `/etc/sudoers.d/lamaste-apphost` | root:root | 0440 | `<user> ALL=(root) NOPASSWD: /usr/local/sbin/lamaste-apphost`, with `env_reset`, `!setenv` and Node.js variables deleted; checked with `visudo -c` before it is renamed into place. None when the agent runs as root |
|
|
959
|
+
| `/etc/lamalibre/apphost/relays/<label>.json` | root:root | 0644 (dirs 0755) | The relay key pinned for agent `<label>`: `{ v, label, agent, kid, publicKey, panelUrl, pinnedAt }` — public material |
|
|
960
|
+
| `/opt/lamalibre/apps/<route>/<version>/` | root:root | dirs 0755, files 0644 | The package as published (`package/`) and `apphost.json`, the spec it was installed with |
|
|
961
|
+
| `/opt/lamalibre/apps/<route>/current`, `previous` | root:root | symlinks | The running version and the one before it; other versions are deleted |
|
|
962
|
+
| `/opt/lamalibre/apps/.stage-<hex>-<route>/` | root:root | 0700 | Unpacking while an install runs |
|
|
963
|
+
| `/var/lib/lamalibre/apps/<route>/` | the agent half's account | 0700 | The agent half's data (`LAMASTE_APP_DATA_DIR`) — kept on removal, deleted by a purge |
|
|
964
|
+
| `/var/lib/lamalibre/apps/<route>/settings.json` | the agent half's account | 0600 | The plugin's non-secret settings and their revision, written by the agent half (`createSettingsStore`) — never a secret |
|
|
965
|
+
| `/var/lib/lamalibre/apps/<route>/secrets.json` | the agent half's account | 0600 | The plugin's secret settings, each with when it was set — the only place they rest |
|
|
966
|
+
| `/var/lib/lamalibre/apps/.owners/<route>.json` | root:root | 0644 (dir 0755) | Who owns the route on this machine: `{ route, package, label, since }` — kept on removal, deleted by a purge |
|
|
967
|
+
| `/var/lib/lamalibre/apps/.jobs/used.json` | root:root | 0600 (dir 0700) | `{ v: 1, jobs: { <jobId>: <expiry, ms> } }` — the signed jobs that ran, each until it expires |
|
|
968
|
+
| `/var/lib/lamalibre/apps/.trash/` | root:root | 0700 | Purged data, deleted there |
|
|
969
|
+
| `/etc/lamalibre/apps/<route>/` | root:\<the account's group\> | 0750 | The agent half's configuration directory |
|
|
970
|
+
| `/etc/lamalibre/apps/<route>/plugin-config.json` | the agent half's account | 0600 | Port and installation secret (`LAMASTE_APP_CONFIG`), the shape of the agent's `app-plugins/<route>.json` |
|
|
971
|
+
| `/etc/systemd/system/lamalibre-app-<route>.service` | root:root | 0644 | The agent half's unit, from a fixed template — paths, never secrets |
|
|
972
|
+
| `/etc/systemd/system/lamalibre-app-<route>.socket` | root:root | 0644 | The socket unit holding the agent half's port: `ListenStream=127.0.0.1:<port>` from the plugin config, `Accept=no`, `NoDelay=true`, `Service=` the unit; systemd passes the socket to the agent half on every start. Written once the plugin config is there, rewritten only when it changes (see [The socket unit](../04-api-reference/app-host.md#the-socket-unit)) |
|
|
973
|
+
| `/run/lamaste-apphost.lock` | root:root | 0600 | Held (with the owner's PID) while a mutating helper command runs |
|
|
970
974
|
|
|
971
975
|
The agent half's account and group are `lamaste-app-<route>` for routes of up to 18 characters, `lamaste-app-<first 2 characters>-<16 hex digits of SHA-256(route)>` otherwise; the account's comment is `lamaste-app route=<route>`. `/opt/lamalibre`, `/opt/lamalibre/apps`, `/var/lib/lamalibre`, `/var/lib/lamalibre/apps`, `/etc/lamalibre` and `/etc/lamalibre/apps` are root-owned 0755.
|
|
972
976
|
|
|
973
|
-
`sudo lamaste-agent apphost disable` removes the rule, the helper and the pins (and `/etc/lamalibre/apphost` when it is empty). Removing an agent half deletes its unit, code and configuration directory; a purge also deletes its data directory, account and owner record. System packages are never removed.
|
|
977
|
+
`sudo lamaste-agent apphost disable` removes the rule, the helper and the pins (and `/etc/lamalibre/apphost` when it is empty). Removing an agent half stops and deletes its unit and its socket unit — releasing its port — with any drop-in directory of the unit, and deletes its code and configuration directory; a purge also deletes its data directory, account and owner record. System packages are never removed.
|
|
974
978
|
|
|
975
979
|
---
|
|
976
980
|
|
|
@@ -1215,6 +1219,7 @@ WantedBy=multi-user.target
|
|
|
1215
1219
|
| `/etc/lamalibre/apps/<route>/` | root:lamaste-app-\<route\> | 0750 | Agent half config directory (agent machine) |
|
|
1216
1220
|
| `/etc/lamalibre/apps/<route>/plugin-config.json` | lamaste-app-\<route\> | 0600 | Agent half port and secret (agent machine) |
|
|
1217
1221
|
| `/etc/systemd/system/lamalibre-app-<route>.service` | root:root | 0644 | Agent half unit (agent machine) |
|
|
1222
|
+
| `/etc/systemd/system/lamalibre-app-<route>.socket` | root:root | 0644 | Agent half socket unit, holds its port (agent machine) |
|
|
1218
1223
|
|
|
1219
1224
|
## Quick Reference
|
|
1220
1225
|
|
|
@@ -24,7 +24,7 @@ If you are reading documentation and hit an unfamiliar term, this is the place t
|
|
|
24
24
|
|
|
25
25
|
**Where it appears:**
|
|
26
26
|
|
|
27
|
-
- Enrolled from the panel (**Certificates → Enrollment Token**) and `lamaste-agent setup` (installed globally with `npm install -g @lamalibre/lamaste-agent@4.
|
|
27
|
+
- Enrolled from the panel (**Certificates → Enrollment Token**) and `lamaste-agent setup` (installed globally with `npm install -g @lamalibre/lamaste-agent@4.4.0`)
|
|
28
28
|
- Agent registry: `/etc/lamalibre/lamaste/agents.json` on the server; `~/.lamalibre/lamaste/agents/<label>/` on the agent
|
|
29
29
|
- The **Agent** column and field on the panel's Tunnels page
|
|
30
30
|
|
|
@@ -242,7 +242,7 @@ See also: [mTLS](#mtls-mutual-tls), [CA](#ca-certificate-authority), [PKCS12](#p
|
|
|
242
242
|
|
|
243
243
|
**Where it appears:**
|
|
244
244
|
|
|
245
|
-
- Generated by `lamaste-agent setup` / `update` (implementation in `@lamalibre/lamaste@4.
|
|
245
|
+
- Generated by `lamaste-agent setup` / `update` (implementation in `@lamalibre/lamaste@4.4.0/agent`)
|
|
246
246
|
- Installed to `~/Library/LaunchAgents/com.lamalibre.lamaste.chisel-<label>.plist` on the agent
|
|
247
247
|
- Manages the Chisel client process lifecycle
|
|
248
248
|
|
|
@@ -373,7 +373,7 @@ See also: [Client Certificate](#client-certificate), [CA](#ca-certificate-author
|
|
|
373
373
|
|
|
374
374
|
**Plain English:** A small scheduled job on every agent that checks with the panel every 30 seconds and adjusts the tunnel client when the agent's tunnels changed — so tunnels created, disabled or moved in the panel reach the agent without anyone running a command on it.
|
|
375
375
|
|
|
376
|
-
**Technical:** Runs `lamaste-agent sync --label <label>`, which fetches `GET /api/tunnels/agent-config` and converges the agent's Chisel client with it (relay URL, credential, pinned binary, granted remotes, running or stopped). It exists because Chisel rejects a client's whole session when one requested remote is not granted: an agent must drop a revoked tunnel promptly or all its other tunnels go dark. Requires a global install of `@lamalibre/lamaste-agent@4.
|
|
376
|
+
**Technical:** Runs `lamaste-agent sync --label <label>`, which fetches `GET /api/tunnels/agent-config` and converges the agent's Chisel client with it (relay URL, credential, pinned binary, granted remotes, running or stopped). It exists because Chisel rejects a client's whole session when one requested remote is not granted: an agent must drop a revoked tunnel promptly or all its other tunnels go dark. Requires a global install of `@lamalibre/lamaste-agent@4.4.0`.
|
|
377
377
|
|
|
378
378
|
**Where it appears:**
|
|
379
379
|
|
|
@@ -1,11 +1,11 @@
|
|
|
1
1
|
# Installer Flags
|
|
2
2
|
|
|
3
|
-
> CLI flags, environment variables, and exit codes for `npx @lamalibre/create-lamaste@4.
|
|
3
|
+
> CLI flags, environment variables, and exit codes for `npx @lamalibre/create-lamaste@4.4.0`.
|
|
4
4
|
|
|
5
5
|
## Usage
|
|
6
6
|
|
|
7
7
|
```bash
|
|
8
|
-
npx @lamalibre/create-lamaste@4.
|
|
8
|
+
npx @lamalibre/create-lamaste@4.4.0 [flags]
|
|
9
9
|
```
|
|
10
10
|
|
|
11
11
|
The installer runs as root on a fresh Ubuntu 24.04 server. It is completely non-interactive by default — all configuration happens later through the browser-based onboarding wizard.
|
|
@@ -26,7 +26,7 @@ The installer runs as root on a fresh Ubuntu 24.04 server. It is completely non-
|
|
|
26
26
|
Prints a description of what the installer does, lists all flags, and exits with code 0. Does not modify anything on the system.
|
|
27
27
|
|
|
28
28
|
```bash
|
|
29
|
-
npx @lamalibre/create-lamaste@4.
|
|
29
|
+
npx @lamalibre/create-lamaste@4.4.0 --help
|
|
30
30
|
```
|
|
31
31
|
|
|
32
32
|
### `--yes`, `-y`
|
|
@@ -34,7 +34,7 @@ npx @lamalibre/create-lamaste@4.3.1 --help
|
|
|
34
34
|
Skips the interactive confirmation prompt that appears before installation begins. Useful for automated deployments or scripts where you cannot press Enter.
|
|
35
35
|
|
|
36
36
|
```bash
|
|
37
|
-
npx @lamalibre/create-lamaste@4.
|
|
37
|
+
npx @lamalibre/create-lamaste@4.4.0 --yes
|
|
38
38
|
```
|
|
39
39
|
|
|
40
40
|
Without this flag, the installer displays a banner listing all changes it will make and waits for the user to press Enter or Ctrl+C.
|
|
@@ -51,7 +51,7 @@ Skips all OS hardening tasks:
|
|
|
51
51
|
Everything else (Node.js, nginx, mTLS, panel deployment) still runs.
|
|
52
52
|
|
|
53
53
|
```bash
|
|
54
|
-
npx @lamalibre/create-lamaste@4.
|
|
54
|
+
npx @lamalibre/create-lamaste@4.4.0 --skip-harden
|
|
55
55
|
```
|
|
56
56
|
|
|
57
57
|
Use this if you manage your own firewall rules, already have fail2ban configured, or are running on a platform that handles security at a different layer.
|
|
@@ -61,7 +61,7 @@ Use this if you manage your own firewall rules, already have fail2ban configured
|
|
|
61
61
|
Allows the installer to run on a machine with a private or non-routable IP address (e.g., `192.168.x.x`, `10.x.x.x`). By default, the installer requires a public IP.
|
|
62
62
|
|
|
63
63
|
```bash
|
|
64
|
-
npx @lamalibre/create-lamaste@4.
|
|
64
|
+
npx @lamalibre/create-lamaste@4.4.0 --dev
|
|
65
65
|
```
|
|
66
66
|
|
|
67
67
|
This is useful for:
|
|
@@ -76,7 +76,7 @@ When `--dev` is active, the installer prints the detected IP with a note: `(dev
|
|
|
76
76
|
Forces the installer to run the complete installation pipeline, ignoring skip guards that would normally detect an existing installation. This is useful when an installation is in an inconsistent state and you want to ensure all components are fully deployed.
|
|
77
77
|
|
|
78
78
|
```bash
|
|
79
|
-
npx @lamalibre/create-lamaste@4.
|
|
79
|
+
npx @lamalibre/create-lamaste@4.4.0 --force-full
|
|
80
80
|
```
|
|
81
81
|
|
|
82
82
|
Use this if:
|
|
@@ -90,7 +90,7 @@ Use this if:
|
|
|
90
90
|
Prints a step-by-step guide for manually removing Lamaste from the server, then exits with code 0. Does not modify anything on the system.
|
|
91
91
|
|
|
92
92
|
```bash
|
|
93
|
-
npx @lamalibre/create-lamaste@4.
|
|
93
|
+
npx @lamalibre/create-lamaste@4.4.0 --uninstall
|
|
94
94
|
```
|
|
95
95
|
|
|
96
96
|
The printed guide first points to the automated removal, `sudo lamaste-server uninstall`, then covers:
|
|
@@ -207,25 +207,25 @@ Components that are always redeployed on re-run:
|
|
|
207
207
|
|
|
208
208
|
```bash
|
|
209
209
|
ssh root@203.0.113.42
|
|
210
|
-
npx @lamalibre/create-lamaste@4.
|
|
210
|
+
npx @lamalibre/create-lamaste@4.4.0
|
|
211
211
|
```
|
|
212
212
|
|
|
213
213
|
**Automated install (no confirmation prompt):**
|
|
214
214
|
|
|
215
215
|
```bash
|
|
216
|
-
npx @lamalibre/create-lamaste@4.
|
|
216
|
+
npx @lamalibre/create-lamaste@4.4.0 --yes
|
|
217
217
|
```
|
|
218
218
|
|
|
219
219
|
**Install without OS hardening:**
|
|
220
220
|
|
|
221
221
|
```bash
|
|
222
|
-
npx @lamalibre/create-lamaste@4.
|
|
222
|
+
npx @lamalibre/create-lamaste@4.4.0 --yes --skip-harden
|
|
223
223
|
```
|
|
224
224
|
|
|
225
225
|
**Test in a local VM:**
|
|
226
226
|
|
|
227
227
|
```bash
|
|
228
|
-
npx @lamalibre/create-lamaste@4.
|
|
228
|
+
npx @lamalibre/create-lamaste@4.4.0 --dev
|
|
229
229
|
```
|
|
230
230
|
|
|
231
231
|
**Update an existing installation:**
|
|
@@ -237,7 +237,7 @@ npx @lamalibre/create-lamaste@latest --yes
|
|
|
237
237
|
**View the uninstall guide:**
|
|
238
238
|
|
|
239
239
|
```bash
|
|
240
|
-
npx @lamalibre/create-lamaste@4.
|
|
240
|
+
npx @lamalibre/create-lamaste@4.4.0 --uninstall
|
|
241
241
|
```
|
|
242
242
|
|
|
243
243
|
## Quick Reference
|
|
@@ -34,7 +34,7 @@ A tunnel's port is also a loopback port on the relay: its vhost proxies to `127.
|
|
|
34
34
|
| 9292 | IP-based panel listener |
|
|
35
35
|
| 9294 | Gatekeeper |
|
|
36
36
|
|
|
37
|
-
A tunnel on one of them would publish that internal service on a public hostname. For the panel that is an administrator takeover, not a leak: the panel trusts the client-certificate headers nginx sets. `RESERVED_TUNNEL_PORTS` in `@lamalibre/lamaste@4.
|
|
37
|
+
A tunnel on one of them would publish that internal service on a public hostname. For the panel that is an administrator takeover, not a leak: the panel trusts the client-certificate headers nginx sets. `RESERVED_TUNNEL_PORTS` in `@lamalibre/lamaste@4.4.0` is enforced by the request schema, inside the tunnel workflow, and again when the Chisel grants are rendered. Tunnel ports must also be 1024–65535.
|
|
38
38
|
|
|
39
39
|
## Systemd Units
|
|
40
40
|
|
|
@@ -217,7 +217,7 @@ The agent's sync timer applies tunnel changes within about 30 seconds. If that d
|
|
|
217
217
|
lamaste-agent update # apply now and (re)install the sync timer
|
|
218
218
|
```
|
|
219
219
|
|
|
220
|
-
`update` needs the agent installed globally (`npm install -g @lamalibre/lamaste-agent@4.
|
|
220
|
+
`update` needs the agent installed globally (`npm install -g @lamalibre/lamaste-agent@4.4.0`); an agent originally set up with `npx` must be installed first.
|
|
221
221
|
|
|
222
222
|
**Cause 3: The agent does not carry the tunnel.**
|
|
223
223
|
|
|
@@ -320,7 +320,7 @@ ls -la /usr/local/bin/authelia
|
|
|
320
320
|
| Missing `panel.json` | `Config file not found` | Re-run installer or create the file manually |
|
|
321
321
|
| Invalid JSON in `panel.json` | `contains invalid JSON` | Fix the JSON syntax |
|
|
322
322
|
| Port 3100 in use | `EADDRINUSE` | Find and stop the conflicting process: `sudo ss -tlnp sport = :3100` |
|
|
323
|
-
| Missing Node.js modules | `Cannot find module` | Re-run the installer (`npx @lamalibre/create-lamaste@4.
|
|
323
|
+
| Missing Node.js modules | `Cannot find module` | Re-run the installer (`npx @lamalibre/create-lamaste@4.4.0 --yes`); `/opt/lamalibre/lamaste` is root-owned and redeployed as a whole |
|
|
324
324
|
| Permission denied writing state | `EACCES` under `/etc/lamalibre/lamaste` | Re-run the installer; the redeploy re-applies the ownership of the config and PKI directories |
|
|
325
325
|
|
|
326
326
|
### chisel fails to start
|
|
@@ -329,7 +329,7 @@ ls -la /usr/local/bin/authelia
|
|
|
329
329
|
|
|
330
330
|
| Cause | Log Message | Fix |
|
|
331
331
|
| -------------------------- | ------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
332
|
-
| Binary missing | `exec format error` or `not found` | Re-run the installer (`npx @lamalibre/create-lamaste@4.
|
|
332
|
+
| Binary missing | `exec format error` or `not found` | Re-run the installer (`npx @lamalibre/create-lamaste@4.4.0 --yes`) — it installs the pinned, checksum-verified release for the server's architecture; the panel cannot install binaries |
|
|
333
333
|
| Not the pinned release | (panel log) `The installed chisel is not the pinned release — run create-lamaste ...` | Re-run the installer. Until then the panel restarts Chisel on every authfile change |
|
|
334
334
|
| Authfile or key unreadable | `permission denied` on `chisel-users` or `chisel-server.key` | Both must be `0640 lamaste:lamaste-chisel` and the unit `Group=lamaste-chisel`; restart the panel, which re-applies the authfile's. If the group, the unit or the key's ownership is wrong, re-run the installer in redeploy mode |
|
|
335
335
|
| Stopped by the panel | (panel log) `Chisel stopped: ...`; unit disabled, `chisel-failed-closed` present | Reconciliation failed closed; see [Tunnel Client Cannot Connect](#tunnel-client-cannot-connect), Cause 1 |
|
|
@@ -343,7 +343,7 @@ ls -la /usr/local/bin/authelia
|
|
|
343
343
|
| --------------------------- | --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
344
344
|
| Invalid `configuration.yml` | `configuration: error` | Check YAML syntax with `authelia validate-configuration --config /etc/authelia/configuration.yml` |
|
|
345
345
|
| Missing `users.yml` | `cannot open file` | Create an initial users file (see [Config Files](config-files.md)) |
|
|
346
|
-
| Binary missing | `not found` | Re-run the installer (`npx @lamalibre/create-lamaste@4.
|
|
346
|
+
| Binary missing | `not found` | Re-run the installer (`npx @lamalibre/create-lamaste@4.4.0 --yes`); it installs the pinned release |
|
|
347
347
|
| Wrong permissions | `permission denied` | Authelia runs as `lamaste-authelia`: `/etc/authelia` must be `lamaste:lamaste-authelia 2770`, `configuration.yml` `0640`, `users.yml` `0660`, `db.sqlite3` owned by `lamaste-authelia`. Re-run the installer to re-apply (a root-owned `/etc/authelia` from an older version is converted), or see [Config Files](config-files.md#file-permissions-table) |
|
|
348
348
|
| Database newer than binary | storage schema version error at startup | A newer Authelia ran against this database and was replaced by an older one; the installer never downgrades an installed Authelia, so reinstall that newer release by hand |
|
|
349
349
|
|
|
@@ -516,14 +516,14 @@ sudo systemctl restart authelia
|
|
|
516
516
|
|
|
517
517
|
## Onboarding Fails: "Chisel is not installed" / "Authelia is not installed"
|
|
518
518
|
|
|
519
|
-
**Symptom:** The **Starting Chisel** or **Configuring Authelia** provisioning task fails with "Chisel is not installed. Run `npx @lamalibre/create-lamaste@4.
|
|
519
|
+
**Symptom:** The **Starting Chisel** or **Configuring Authelia** provisioning task fails with "Chisel is not installed. Run `npx @lamalibre/create-lamaste@4.4.0` on the server to repair the installation." (or the same for Authelia).
|
|
520
520
|
|
|
521
521
|
**Cause:** Onboarding downloads nothing: the installer installs both binaries (pinned releases), their systemd units and the `lamaste-authelia` account. The binary at `/usr/local/bin/chisel` or `/usr/local/bin/authelia` is missing — the installer was interrupted, or the file was removed.
|
|
522
522
|
|
|
523
523
|
**Fix:** Re-run the installer on the server, then start provisioning again from the wizard:
|
|
524
524
|
|
|
525
525
|
```bash
|
|
526
|
-
npx @lamalibre/create-lamaste@4.
|
|
526
|
+
npx @lamalibre/create-lamaste@4.4.0 --yes
|
|
527
527
|
```
|
|
528
528
|
|
|
529
529
|
If provisioning then fails writing Authelia's configuration with `/etc/authelia is not writable by the panel — run create-lamaste to repair the installation`, the directory's ownership is wrong; the same command repairs it.
|
|
@@ -538,7 +538,7 @@ If provisioning then fails writing Authelia's configuration with `/etc/authelia
|
|
|
538
538
|
|
|
539
539
|
**Fix:**
|
|
540
540
|
|
|
541
|
-
1. Re-run the installer so the helper matches the panel: `npx @lamalibre/create-lamaste@4.
|
|
541
|
+
1. Re-run the installer so the helper matches the panel: `npx @lamalibre/create-lamaste@4.4.0 --yes`
|
|
542
542
|
2. If it persists on a current install, it is a bug: the vhost generators (`packages/server/daemon/src/lib/nginx.js`) and the allow-list (`packages/provisioners/server/scripts/lamaste-priv`) must change together — `npm test` checks every generated vhost against the allow-list. Do not work around it by editing files in `/etc/nginx` by hand.
|
|
543
543
|
|
|
544
544
|
`sudo: a password is required` for `lamaste-priv` means the helper or the sudoers file is missing or outdated: re-run the installer.
|
|
@@ -621,7 +621,7 @@ df -h /
|
|
|
621
621
|
|
|
622
622
|
**Cause 3: The web root is not writable by the panel (`EACCES`).**
|
|
623
623
|
|
|
624
|
-
The panel writes `/var/www/lamaste` itself: it must be `lamaste:www-data`, directories `2750`, files `0640`. An install from before this layout had it owned by `www-data`. Re-run the installer (`npx @lamalibre/create-lamaste@4.
|
|
624
|
+
The panel writes `/var/www/lamaste` itself: it must be `lamaste:www-data`, directories `2750`, files `0640`. An install from before this layout had it owned by `www-data`. Re-run the installer (`npx @lamalibre/create-lamaste@4.4.0 --yes`); the redeploy converts the tree.
|
|
625
625
|
|
|
626
626
|
---
|
|
627
627
|
|
|
@@ -2,9 +2,9 @@
|
|
|
2
2
|
|
|
3
3
|
## Overview
|
|
4
4
|
|
|
5
|
-
`@lamalibre/lamaste-gatekeeper@4.
|
|
5
|
+
`@lamalibre/lamaste-gatekeeper@4.4.0` is a standalone authorization package for Lamaste. It manages **groups** and **grants**, enforces tunnel access control via a lightweight Fastify service, and serves user-friendly "request access" pages when access is denied.
|
|
6
6
|
|
|
7
|
-
It follows the same architectural pattern as `@lamalibre/lamaste-tickets@4.
|
|
7
|
+
It follows the same architectural pattern as `@lamalibre/lamaste-tickets@4.4.0` — a solid library at the core, with a service, CLI, and desktop as consumers.
|
|
8
8
|
|
|
9
9
|
---
|
|
10
10
|
|
|
@@ -204,7 +204,7 @@ The grant system is resource-agnostic. It doesn't know what a "tunnel" or "plugi
|
|
|
204
204
|
|
|
205
205
|
```js
|
|
206
206
|
import { createGroup, listGroups, getGroup, updateGroup, deleteGroup,
|
|
207
|
-
addMembers, removeMembers, getGroupsForUser } from '@lamalibre/lamaste-gatekeeper@4.
|
|
207
|
+
addMembers, removeMembers, getGroupsForUser } from '@lamalibre/lamaste-gatekeeper@4.4.0';
|
|
208
208
|
|
|
209
209
|
createGroup(name, { description?, createdBy? })
|
|
210
210
|
// → { name, description, members: [], createdAt, createdBy }
|
|
@@ -240,7 +240,7 @@ getGroupsForUser(username)
|
|
|
240
240
|
### Grants
|
|
241
241
|
|
|
242
242
|
```js
|
|
243
|
-
import { createGrant, listGrants, getGrant, revokeGrant } from '@lamalibre/lamaste-gatekeeper@4.
|
|
243
|
+
import { createGrant, listGrants, getGrant, revokeGrant } from '@lamalibre/lamaste-gatekeeper@4.4.0';
|
|
244
244
|
|
|
245
245
|
createGrant({ principalType, principalId, resourceType, resourceId, context? })
|
|
246
246
|
// → grant object
|
|
@@ -267,7 +267,7 @@ revokeGrant(grantId)
|
|
|
267
267
|
### Authorization
|
|
268
268
|
|
|
269
269
|
```js
|
|
270
|
-
import { checkAccess } from '@lamalibre/lamaste-gatekeeper@4.
|
|
270
|
+
import { checkAccess } from '@lamalibre/lamaste-gatekeeper@4.4.0';
|
|
271
271
|
|
|
272
272
|
checkAccess(username, resourceType, resourceId);
|
|
273
273
|
// 1. Find direct user grants: principalType='user', principalId=username
|
|
@@ -282,7 +282,7 @@ checkAccess(username, resourceType, resourceId);
|
|
|
282
282
|
### Templates
|
|
283
283
|
|
|
284
284
|
```js
|
|
285
|
-
import { getAccessRequestTemplates } from '@lamalibre/lamaste-gatekeeper@4.
|
|
285
|
+
import { getAccessRequestTemplates } from '@lamalibre/lamaste-gatekeeper@4.4.0';
|
|
286
286
|
|
|
287
287
|
getAccessRequestTemplates(username, resourceName, { adminContact?, domain? })
|
|
288
288
|
// → {
|
|
@@ -864,14 +864,14 @@ On first startup, gatekeeper checks for legacy files:
|
|
|
864
864
|
|
|
865
865
|
### Panel-Server Refactoring
|
|
866
866
|
|
|
867
|
-
- `lib/user-access.js` → delegates to gatekeeper library (import from `@lamalibre/lamaste-gatekeeper@4.
|
|
867
|
+
- `lib/user-access.js` → delegates to gatekeeper library (import from `@lamalibre/lamaste-gatekeeper@4.4.0`)
|
|
868
868
|
- `lib/access-control-sync.js` → removed (gatekeeper handles authorization at nginx layer, no more Authelia config rewriting for per-user access rules)
|
|
869
869
|
- `routes/user-access.js` → simplified, delegates grant CRUD to gatekeeper
|
|
870
870
|
- Tunnel creation/update routes → call gatekeeper for access mode changes
|
|
871
871
|
|
|
872
872
|
### Installer Updates (create-lamaste)
|
|
873
873
|
|
|
874
|
-
- Install `@lamalibre/lamaste-gatekeeper@4.
|
|
874
|
+
- Install `@lamalibre/lamaste-gatekeeper@4.4.0` package
|
|
875
875
|
- Create `/etc/lamalibre/lamaste/groups.json` (empty initial state)
|
|
876
876
|
- Create `/etc/lamalibre/lamaste/access-grants.json` (empty or migrated)
|
|
877
877
|
- Create `lamalibre-lamaste-gatekeeper.service` systemd unit
|