@lamalibre/create-lamaste 4.5.0 → 4.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamalibre/create-lamaste",
-  "version": "4.5.0",
+  "version": "4.7.0",
   "description": "One-command setup for secure reverse tunnels with a management dashboard",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -43,7 +43,7 @@
     "mtls"
   ],
   "dependencies": {
-    "@lamalibre/lamaste": "^4.5.0",
+    "@lamalibre/lamaste": "^4.7.0",
     "chalk": "^5.3.0",
     "execa": "^9.0.0",
     "listr2": "^8.0.0"

package/scripts/bundle-vendor.js

@@ -13,6 +13,7 @@ import { execFileSync } from 'node:child_process';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { assertProductionBundle } from '../../../../scripts/assert-production-bundle.js';
+import { workspaceVersions, writePinnedManifest } from './pin-release.js';
 
 const thisDir = dirname(fileURLToPath(import.meta.url));
 const packageRoot = join(thisDir, '..');
@@ -24,6 +25,10 @@ async function main() {
   await rm(vendorDir, { recursive: true, force: true });
   await mkdir(vendorDir, { recursive: true });
 
+  // Each vendored manifest names this release's own packages exactly
+  // (pin-release.js), so the relay's `npm install` never mixes releases.
+  const versions = await workspaceVersions(monorepoRoot);
+
   // --- lamaste-serverd: package.json + src/ ---
   const serverSrc = join(monorepoRoot, 'packages', 'server', 'daemon');
   if (!existsSync(serverSrc)) {
@@ -32,7 +37,11 @@ async function main() {
 
   const serverDest = join(vendorDir, 'serverd');
   await mkdir(serverDest, { recursive: true });
-  await cp(join(serverSrc, 'package.json'), join(serverDest, 'package.json'));
+  await writePinnedManifest(
+    join(serverSrc, 'package.json'),
+    join(serverDest, 'package.json'),
+    versions,
+  );
   await cp(join(serverSrc, 'src'), join(serverDest, 'src'), {
     recursive: true,
   });
@@ -49,7 +58,11 @@ async function main() {
   }
   const serverCliDest = join(vendorDir, 'server');
   await mkdir(serverCliDest, { recursive: true });
-  await cp(join(serverCliSrc, 'package.json'), join(serverCliDest, 'package.json'));
+  await writePinnedManifest(
+    join(serverCliSrc, 'package.json'),
+    join(serverCliDest, 'package.json'),
+    versions,
+  );
   await cp(join(serverCliSrc, 'bin'), join(serverCliDest, 'bin'), { recursive: true });
   await cp(join(serverCliSrc, 'src'), join(serverCliDest, 'src'), { recursive: true });
   console.error('Bundled vendor/server from lamaste-server CLI (package.json + bin/ + src/)');
@@ -81,7 +94,11 @@ async function main() {
   }
   const gatekeeperDest = join(vendorDir, 'gatekeeper');
   await mkdir(gatekeeperDest, { recursive: true });
-  await cp(join(gatekeeperSrc, 'package.json'), join(gatekeeperDest, 'package.json'));
+  await writePinnedManifest(
+    join(gatekeeperSrc, 'package.json'),
+    join(gatekeeperDest, 'package.json'),
+    versions,
+  );
   await cp(gatekeeperDist, join(gatekeeperDest, 'dist'), { recursive: true });
   console.error('Bundled vendor/gatekeeper (package.json + dist/)');
 

package/scripts/lamaste-priv

@@ -81,21 +81,37 @@ class UsageError extends Error {}
 // ---------------------------------------------------------------------------
 
 const LABEL = '[a-z0-9](?:[a-z0-9-]{0,78}[a-z0-9])?';
+/** A full hostname, lower case, two labels at least — what names a vhost since the multi-domain relay. */
+const HOST = '[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+';
 const UUID = '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}';
 
-/** Vhosts the panel writes. */
+/**
+ * Vhosts the panel writes: the panel's and chisel's (primary domain), one
+ * auth portal per domain, a tunnel's by its full hostname, a site's by id.
+ */
 const PANEL_SITE_RE = new RegExp(
-  `^lamalibre-lamaste-(?:panel-domain|auth|tunnel|app-${LABEL}|agent-panel-${LABEL}|site-${UUID})$`,
+  `^lamalibre-lamaste-(?:panel-domain|tunnel|auth-${HOST}|app-${HOST}|agent-panel-${HOST}|site-${UUID})$`,
 );
 
+/**
+ * Vhost names before the multi-domain relay — the auth portal and tunnels
+ * by subdomain alone. The panel renames them at start; it may still link,
+ * unlink, back up, restore and remove them, but never write one.
+ */
+const LEGACY_SITE_RE = new RegExp(`^lamalibre-lamaste-(?:auth|app-${LABEL}|agent-panel-${LABEL})$`);
+
 /** Vhosts create-lamaste writes that the panel may only switch on and off. */
 const TOGGLE_ONLY_SITES = new Set(['lamalibre-lamaste-panel-ip']);
 
+/** The longest site name: a file name, with room for its `.bak`. */
+const MAX_SITE_NAME = 250;
+
 function assertSiteName(name, action) {
-  if (typeof name !== 'string' || name.length > 128) {
+  if (typeof name !== 'string' || name.length > MAX_SITE_NAME) {
     throw new UsageError('invalid site name');
   }
   if (PANEL_SITE_RE.test(name)) return;
+  if (action !== 'write' && LEGACY_SITE_RE.test(name)) return;
   if ((action === 'enable' || action === 'disable') && TOGGLE_ONLY_SITES.has(name)) return;
   throw new UsageError(`site name not allowed for ${action}: ${name}`);
 }
@@ -251,6 +267,12 @@ const WEBROOT_RE = /^\/var\/www\/lamaste\/[A-Za-z0-9._/-]*$/;
 const HEADER_NAME_RE = /^[A-Za-z0-9-]{1,64}$/;
 const VARIABLE_RE = /^\$[A-Za-z_][A-Za-z0-9_]{0,63}$/;
 const URI_PATH_RE = /^\/[A-Za-z0-9._~/-]*$/;
+/** A named location (`location @previous`), the target of a try_files fallback. */
+const NAMED_LOCATION_RE = /^@[a-z][a-z0-9_]{0,31}$/;
+const TRY_FILES_ARG_RE = /^[A-Za-z0-9._/$=-]{1,256}$/;
+/** A `types` entry: a media type, then the extensions served with it. */
+const MEDIA_TYPE_RE = /^[a-z]+\/[a-z0-9.+-]{1,64}$/;
+const EXTENSION_RE = /^[a-z0-9]{1,16}$/;
 
 function hasDotDotSegment(p) {
   return p.split('/').some((seg) => seg === '..' || seg === '.');
@@ -317,18 +339,27 @@ const RULES = {
     error_page: { args: errorPageArgs },
     return: { args: argc(1, 2) },
     rewrite: { args: rewriteArgs },
+    // A host whose every location asks the same authorization (a plugin's
+    // web surface): a URI of this server, never a file.
+    auth_request: { args: (a) => a.length === 1 && (a[0] === 'off' || URI_PATH_RE.test(a[0])) },
     location: { block: 'location', args: locationArgs },
   },
   location: {
     location: { block: 'location', args: locationArgs },
     if: { block: 'if', args: argc(1, 5) },
+    // The content types of a plugin's web surface, named by the vhost
+    // rather than the host's mime.types (entries checked below).
+    types: { block: 'types', args: argc(0, 0) },
     internal: { args: argc(0, 0) },
+    // The type of a body the location writes itself (a user surface's JSON
+    // refusal): a media type, never a file.
+    default_type: { args: (a) => a.length === 1 && /^[a-z]+\/[a-z0-9.+-]{1,64}$/.test(a[0]) },
     return: { args: argc(1, 2) },
     rewrite: { args: rewriteArgs },
     root: { args: (a) => a.length === 1 && webrootPath(a[0]) },
     alias: { args: (a) => a.length === 1 && webrootPath(a[0]) },
     index: { args: each(/^[A-Za-z0-9._-]{1,64}$/) },
-    try_files: { args: each(/^[A-Za-z0-9._/$=-]{1,256}$/) },
+    try_files: { args: tryFilesArgs },
     add_header: {
       args: (a) =>
         (a.length === 2 || (a.length === 3 && a[2] === 'always')) && HEADER_NAME_RE.test(a[0]),
@@ -386,8 +417,20 @@ function rewriteArgs(a) {
   );
 }
 
+/** Files to try under the location's root; the last may instead name a location. */
+function tryFilesArgs(a) {
+  if (a.length === 0) return false;
+  const last = a[a.length - 1];
+  return (
+    a.slice(0, -1).every((v) => TRY_FILES_ARG_RE.test(v)) &&
+    (TRY_FILES_ARG_RE.test(last) || NAMED_LOCATION_RE.test(last))
+  );
+}
+
 function locationArgs(a) {
-  if (a.length === 1) return a[0].length <= 512 && a[0].startsWith('/');
+  if (a.length === 1) {
+    return (a[0].length <= 512 && a[0].startsWith('/')) || NAMED_LOCATION_RE.test(a[0]);
+  }
   return a.length === 2 && ['=', '~', '~*', '^~'].includes(a[0]) && a[1].length <= 512;
 }
 
@@ -407,6 +450,14 @@ function validateDirectives(directives, context) {
       }
       continue;
     }
+    if (context === 'types') {
+      // types entries are "media/type ext...;" — no block, no include.
+      if (d.block !== null) throw new UsageError(`vhost line ${d.line}: block inside types`);
+      if (!MEDIA_TYPE_RE.test(d.name) || !each(EXTENSION_RE)(d.args)) {
+        throw new UsageError(`vhost line ${d.line}: malformed types entry`);
+      }
+      continue;
+    }
     const rule = rules[d.name];
     if (!rule) {
       throw new UsageError(

package/scripts/pin-release.js

@@ -0,0 +1,98 @@
+/**
+ * Pins a vendored package's dependencies on this monorepo's packages to the
+ * exact versions it was built with.
+ *
+ * create-lamaste vendors serverd, the server CLI and Gatekeeper, then runs
+ * `npm install` for them on the relay. Their manifests name the core
+ * library with a caret range (`^4.6.0`), so an install of release X made
+ * after X+1 shipped resolved X+1's core — and 4.6.0's serverd on 4.7.0's
+ * core did not start. Pinned, create-lamaste@X always installs the core,
+ * tickets and identity libraries of release X; third-party dependencies
+ * keep their ranges.
+ */
+
+import { readFile, readdir, writeFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+
+const DEPENDENCY_FIELDS = ['dependencies', 'optionalDependencies', 'peerDependencies'];
+
+/**
+ * The name → version of every workspace package (`packages/<group>/<name>`).
+ *
+ * @param {string} monorepoRoot
+ * @returns {Promise<Map<string, string>>}
+ */
+export async function workspaceVersions(monorepoRoot) {
+  const versions = new Map();
+  const packagesDir = join(monorepoRoot, 'packages');
+  for (const group of await readdir(packagesDir, { withFileTypes: true })) {
+    if (!group.isDirectory()) continue;
+    for (const entry of await readdir(join(packagesDir, group.name), { withFileTypes: true })) {
+      const manifestPath = join(packagesDir, group.name, entry.name, 'package.json');
+      if (!entry.isDirectory() || !existsSync(manifestPath)) continue;
+      const { name, version } = JSON.parse(await readFile(manifestPath, 'utf8'));
+      if (typeof name === 'string' && typeof version === 'string') versions.set(name, version);
+    }
+  }
+  return versions;
+}
+
+/**
+ * The manifest with each dependency on a workspace package set to that
+ * package's exact version. Pure; throws on a workspace dependency whose
+ * range the workspace's version does not satisfy as a caret or exact range
+ * (the vendored code would then be pinned to something it was not written
+ * against).
+ *
+ * @param {Record<string, unknown>} manifest
+ * @param {Map<string, string>} versions
+ * @returns {Record<string, unknown>}
+ */
+export function pinWorkspaceDependencies(manifest, versions) {
+  const pinned = { ...manifest };
+  for (const field of DEPENDENCY_FIELDS) {
+    const deps = manifest[field];
+    if (deps === null || typeof deps !== 'object') continue;
+    const next = { ...deps };
+    for (const [name, range] of Object.entries(deps)) {
+      const version = versions.get(name);
+      if (version === undefined) continue;
+      if (range !== version && !caretAdmits(range, version)) {
+        throw new Error(
+          `${manifest.name}: ${field}.${name} is "${range}", the workspace has ${version}`,
+        );
+      }
+      next[name] = version;
+    }
+    pinned[field] = next;
+  }
+  return pinned;
+}
+
+/** Whether `^a.b.c` admits `version` (same major, not lower). */
+function caretAdmits(range, version) {
+  const match = /^\^(\d+)\.(\d+)\.(\d+)$/.exec(String(range));
+  const have = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
+  if (!match || !have) return false;
+  const [want, got] = [match.slice(1).map(Number), have.slice(1).map(Number)];
+  if (want[0] !== got[0]) return false;
+  for (let i = 1; i < 3; i++) if (got[i] !== want[i]) return got[i] > want[i];
+  return true;
+}
+
+/**
+ * Copy `source` (a package.json) to `dest` with its workspace dependencies
+ * pinned.
+ *
+ * @param {string} source
+ * @param {string} dest
+ * @param {Map<string, string>} versions
+ */
+export async function writePinnedManifest(source, dest, versions) {
+  const manifest = JSON.parse(await readFile(source, 'utf8'));
+  await writeFile(
+    dest,
+    `${JSON.stringify(pinWorkspaceDependencies(manifest, versions), null, 2)}\n`,
+  );
+}

package/src/index.js

@@ -12,7 +12,7 @@ import { existsSync } from 'node:fs';
 import { Listr } from 'listr2';
 import chalk from 'chalk';
 import { execa } from 'execa';
-import { detectOS, detectIP, checkRoot } from './lib/env.js';
+import { detectOS, detectIP, checkRoot, installedPanelIp } from './lib/env.js';
 import { printSummary } from './lib/summary.js';
 import { readPanelKeyPin } from './lib/panel-pin.js';
 import { hardenTasks } from './tasks/harden.js';
@@ -485,6 +485,13 @@ export async function main() {
             {
               title: 'Detecting IP address',
               task: async (_ctx, subtask) => {
+                // A redeploy keeps the installed relay's IP (installedPanelIp).
+                const installedIp = flags.forceFull ? null : await installedPanelIp();
+                if (installedIp) {
+                  ctx.ip = installedIp;
+                  subtask.output = `${installedIp} (the installed relay's, from panel.json)`;
+                  return;
+                }
                 ctx.ip = await detectIP({ allowPrivate: flags.dev });
                 if (flags.dev) {
                   subtask.output = `${ctx.ip} (dev mode — private IP accepted)`;

package/src/lib/env.js

@@ -123,6 +123,25 @@ function isPublicIP(ip) {
  * Verify the process is running as root.
  * @throws {Error} if not root
  */
+/**
+ * The IP an installed relay was set up with (`panel.json` `ip`), or null —
+ * no install, no readable file, or no valid IPv4 in it. A redeploy keeps
+ * it: the panel's IP certificate, agents and admins know the relay by it,
+ * and detecting again could change it (or fail, where the installer's
+ * public-IP check does not hold — a dev install on a private address).
+ *
+ * @param {string} [panelJsonPath]
+ * @returns {Promise<string | null>}
+ */
+export async function installedPanelIp(panelJsonPath = '/etc/lamalibre/lamaste/panel.json') {
+  try {
+    const { ip } = JSON.parse(await readFile(panelJsonPath, 'utf8'));
+    return typeof ip === 'string' && isValidIPv4(ip) ? ip : null;
+  } catch {
+    return null;
+  }
+}
+
 export function checkRoot() {
   if (process.getuid() !== 0) {
     throw new Error(

package/src/lib/service-config.js

@@ -265,12 +265,19 @@ WantedBy=multi-user.target
  * Installed by create-lamaste only; onboarding writes the configuration,
  * then enables and starts it.
  *
+ * No start rate limit (`StartLimitIntervalSec=0`): the panel restarts
+ * Authelia for every change of membership, domains or OIDC clients, and
+ * systemd's default (5 starts in 10 s) refused the sixth of a quick series
+ * of admin changes — Authelia then stayed down on every domain until
+ * something started it again. A crash loop stays bounded by `RestartSec=5`.
+ *
  * @returns {string}
  */
 export function generateAutheliaUnit() {
   return `[Unit]
 Description=Authelia Authentication Server
 After=network.target
+StartLimitIntervalSec=0
 
 [Service]
 Type=simple

package/src/tasks/redeploy.js

@@ -24,6 +24,7 @@ import {
   nodeVersionTooNew,
 } from '../lib/node-version.js';
 import { deployGatekeeperPackage } from './gatekeeper.js';
+import { autheliaReady } from '@lamalibre/lamaste/server';
 
 const GATEKEEPER_SERVICE = 'lamalibre-lamaste-gatekeeper';
 
@@ -447,6 +448,13 @@ export function redeployTasks(ctx, task) {
         if (ctx.autheliaWasActive) {
           subtask.output = 'Starting Authelia...';
           await execa('systemctl', ['start', 'authelia']);
+          // systemctl returns when the process is spawned; the panel, which
+          // starts next, talks to Authelia at once.
+          if (!(await autheliaReady(execa))) {
+            throw new Error(
+              'Authelia is not serving requests after the redeploy — see journalctl -u authelia',
+            );
+          }
         }
         if (ctx.gatekeeperWasActive) {
           subtask.output = 'Starting gatekeeper...';

package/vendor/docs/00-introduction/how-it-works.md

@@ -55,14 +55,14 @@ SSH into a fresh Ubuntu droplet and run one command:
 
 ```bash
 apt install -y npm
-npx @lamalibre/create-lamaste@4.5.0
+npx @lamalibre/create-lamaste@4.7.0
 ```
 
 This installs everything the relay needs: nginx, Node.js, firewall rules, certificates, and the management panel. At the end, it prints a client certificate file and password. You download the certificate, import it into your browser, and disconnect SSH. You never SSH in again.
 
 **Option B: Desktop app (cloud provisioning)**
 
-Install the desktop app (`npx @lamalibre/create-lamaste-desktop@4.5.0`) and use the Servers tab to create a DigitalOcean droplet. The app handles everything — droplet creation, Lamaste installation, certificate download, and connection — without you ever touching SSH. Cloud API tokens are stored in your OS credential store (macOS Keychain or Linux libsecret), never in plaintext. See the [Cloud Provisioning guide](../02-guides/cloud-provisioning.md) for a step-by-step walkthrough.
+Install the desktop app (`npx @lamalibre/create-lamaste-desktop@4.7.0`) and use the Servers tab to create a DigitalOcean droplet. The app handles everything — droplet creation, Lamaste installation, certificate download, and connection — without you ever touching SSH. Cloud API tokens are stored in your OS credential store (macOS Keychain or Linux libsecret), never in plaintext. See the [Cloud Provisioning guide](../02-guides/cloud-provisioning.md) for a step-by-step walkthrough.
 
 **Phase 2: Onboarding (10 minutes, browser)**
 

package/vendor/docs/00-introduction/quickstart.md

@@ -59,7 +59,7 @@ Once connected:
 
 ```bash
 apt install -y npm
-npx @lamalibre/create-lamaste@4.5.0
+npx @lamalibre/create-lamaste@4.7.0
 ```
 
 The installer displays a confirmation banner showing what it will do:
@@ -253,7 +253,7 @@ Every tunnel is carried by one **agent** — the machine that runs the app. Enro
 Install the Lamaste Desktop app, which provides a GUI with automatic service discovery and one-click tunnel creation:
 
 ```bash
-npx @lamalibre/create-lamaste-desktop@4.5.0
+npx @lamalibre/create-lamaste-desktop@4.7.0
 ```
 
 The app auto-detects local services (Ollama, ComfyUI, PostgreSQL, Docker containers, etc.) and lets you expose them with one click. See the [Desktop App Setup](../02-guides/desktop-app-setup.md) guide for details.
@@ -263,7 +263,7 @@ The app auto-detects local services (Ollama, ComfyUI, PostgreSQL, Docker contain
 In the panel, go to **Certificates → Enrollment Token** and create a token for a label such as `laptop`. Then, on the machine that runs your app, install the agent globally and run setup:
 
 ```bash
-npm install -g @lamalibre/lamaste-agent@4.5.0
+npm install -g @lamalibre/lamaste-agent@4.7.0
 LAMALIBRE_LAMASTE_ENROLLMENT_TOKEN=<token> \
   lamaste-agent setup --label laptop --panel-url https://203.0.113.42:9292
 ```
@@ -345,7 +345,7 @@ Your Mac                          DigitalOcean Droplet            Internet
 The installer accepts optional flags:
 
 ```bash
-npx @lamalibre/create-lamaste@4.5.0 [flags]
+npx @lamalibre/create-lamaste@4.7.0 [flags]
 ```
 
 | Flag            | Effect                                          |
@@ -435,7 +435,7 @@ In development mode (`NODE_ENV=development` or `NODE_ENV` unset), the panel serv
 # 2. SSH in and install
 ssh root@203.0.113.42
 apt install -y npm
-npx @lamalibre/create-lamaste@4.5.0
+npx @lamalibre/create-lamaste@4.7.0
 
 # 3. Download cert (from your local machine)
 scp root@203.0.113.42:/etc/lamalibre/lamaste/pki/client.p12 .

package/vendor/docs/00-introduction/what-is-lamaste.md

@@ -36,7 +36,7 @@ Lamaste solves the problem of exposing local services to the internet securely.
 **Option A: Manual setup (SSH)**
 
 1. Create a fresh Ubuntu 24.04 droplet on DigitalOcean
-2. SSH in once and run `npx @lamalibre/create-lamaste@4.5.0`
+2. SSH in once and run `npx @lamalibre/create-lamaste@4.7.0`
 3. Download the client certificate it prints
 4. Import the certificate into your browser
 5. Open `https://<droplet-ip>:9292` — you are in the admin panel
@@ -46,7 +46,7 @@ Lamaste solves the problem of exposing local services to the internet securely.
 
 **Option B: Desktop app cloud provisioning**
 
-1. Install the desktop app (`npx @lamalibre/create-lamaste-desktop@4.5.0`)
+1. Install the desktop app (`npx @lamalibre/create-lamaste-desktop@4.7.0`)
 2. Go to the Servers tab and click "Create a new server"
 3. Enter your DigitalOcean API token — the app validates scopes and stores it securely in your OS credential store
 4. Pick a region (the app measures latency to each) and a domain name
@@ -93,14 +93,14 @@ All backend services bind `127.0.0.1` only — nginx is the sole public-facing s
 
 State is stored in JSON files (`/etc/lamalibre/lamaste/panel.json`, `tunnels.json`) with atomic writes (write to temp → fsync → rename). No database is needed at this scale.
 
-The installer (`npx @lamalibre/create-lamaste@4.5.0`) is completely non-interactive — it detects the environment, provisions everything, and prints a summary. All configuration happens through the browser-based onboarding wizard after installation.
+The installer (`npx @lamalibre/create-lamaste@4.7.0`) is completely non-interactive — it detects the environment, provisions everything, and prints a summary. All configuration happens through the browser-based onboarding wizard after installation.
 
 ## Quick Reference
 
 | Item                 | Value                           |
 | -------------------- | ------------------------------- |
 | **Minimum VPS**      | 512MB RAM, Ubuntu 24.04         |
-| **Install command**  | `npx @lamalibre/create-lamaste@4.5.0` |
+| **Install command**  | `npx @lamalibre/create-lamaste@4.7.0` |
 | **Admin panel**      | `https://<ip>:9292` (mTLS)      |
 | **Auth for admin**   | Client certificate (zero-login) |
 | **Auth for apps**    | TOTP 2FA via Authelia           |
@@ -108,5 +108,5 @@ The installer (`npx @lamalibre/create-lamaste@4.5.0`) is completely non-interact
 | **TLS certificates** | Let's Encrypt (auto-renewing)   |
 | **State storage**    | JSON files (no database)        |
 | **RAM usage**        | ~245MB total (all services)     |
-| **npm package**      | `@lamalibre/create-lamaste@4.5.0`     |
+| **npm package**      | `@lamalibre/create-lamaste@4.7.0`     |
 | **License**          | Polyform Noncommercial 1.0.0    |

package/vendor/docs/01-concepts/authentication.md

@@ -40,7 +40,7 @@ From the Users page in the management panel, you can:
 1. Navigate to the Users page in the management panel
 2. Click "Add User"
 3. Enter a username, display name, email, and password
-4. Lamaste creates the user in `users.yml` and restarts Authelia
+4. Lamaste creates the user in `users.yml`; Authelia reloads it in place
 5. Share the credentials with the user — they enroll in TOTP on first login
 
 ### TOTP enrollment flow
@@ -221,7 +221,7 @@ users:
 
 Lamaste manages this file through the panel server API. All writes are atomic: content is written to a temporary file first, then moved into place. This prevents Authelia from reading a partially written file.
 
-After every write to `users.yml`, the panel server reloads Authelia via `systemctl restart authelia` so the changes take effect.
+Authelia watches `users.yml` (`authentication_backend.file.watch: true`) and reloads it in place; with the watch it re-reads a user's details at each of their requests, so a change applies at the user's next request without a restart and without ending anyone else's session. It skips a reload within 0.5 s of the previous one, so the panel writes the file once more 0.6 s after its last write.
 
 ### Creating users programmatically
 
@@ -420,6 +420,10 @@ Key choices:
 
 See [Registry Credential and OIDC Clients](../04-api-reference/registry-and-oidc.md) for the manifest fields and the API.
 
+### Several domains
+
+On a relay with several domains Authelia carries one `session.cookies` entry per active domain (each `authelia_url: https://auth.<domain>`), so each domain's sign-in sets and reads its own `authelia_session` cookie — same name, scoped by the browser. `access_control` admits each domain's active members on the domain and every host under it (protected sites' rules narrowed to members), then denies; `default_policy` is `deny`. OIDC sign-ins are gated by per-domain `authorization_policies`, since `access_control` does not apply to them, and each domain is an issuer of its own (`https://auth.<domain>`). The panel renders all of it from the directory's memberships ([Domains API](../04-api-reference/domains.md)); on a one-domain relay every user is the domain's member, which admits whom it did before. TOTP is per person, not per domain.
+
 ### Safety rule: never delete the last user
 
 The panel server API prevents deleting the last Authelia user. If only one user exists and you try to delete them, the API returns an error. This prevents a lockout scenario where no one can authenticate to reach the tunneled apps.

package/vendor/docs/01-concepts/authorization.md

@@ -102,6 +102,10 @@ From the Gatekeeper dashboard in the admin panel:
 
 Gatekeeper reads groups and grants from its SQLite database (`gatekeeper.db`) on every check, so a group, member or grant created through the admin panel takes effect on the next request — no service restart required. The tunnel list (the panel's `tunnels.json`) and Gatekeeper's settings (`gatekeeper.json`) are watched and reloaded when they change. Changes through the panel also recompute the audiences of agent-hosted plugins at once; edits made with Gatekeeper's own CLI are picked up by the panel within a minute.
 
+### Domains and membership
+
+On a relay with several domains, membership of a host's domain comes before every access mode: `authenticated` means "any signed-in member of this domain", and `restricted` still needs a grant on top. Membership is rendered into Authelia and checked again by Gatekeeper from the panel's `domains.json`; a signed-in non-member gets a "not a member of this domain" page — with the admin contact and a sign-out link — rather than the sign-in page. Members are managed per domain ([Domains API](../04-api-reference/domains.md)); the admin certificate manages every domain, and Authelia's `admins` group needs membership like everyone else (inside a domain it still passes `restricted` sites).
+
 ## For Developers
 
 ### Architecture

package/vendor/docs/01-concepts/certificates.md

@@ -29,7 +29,7 @@ For the IP-based admin panel (`https://<ip>:9292`), there is no domain to verify
 
 ### When certificates are issued
 
-- **Self-signed + mTLS certs** — created during `npx @lamalibre/create-lamaste@4.5.0` installation
+- **Self-signed + mTLS certs** — created during `npx @lamalibre/create-lamaste@4.7.0` installation
 - **Core Let's Encrypt certs** — issued during onboarding for `panel`, `auth`, and `tunnel` subdomains
 - **App Let's Encrypt certs** — issued when you create a new tunnel or a managed static site
 - **Custom-domain site certs** — issued when a custom-domain site's DNS is verified: one certificate lineage, named after the site's domain, covering the domain and every redirect alias (re-issued when aliases change)
@@ -82,7 +82,7 @@ The most critical scenario is the mTLS CA expiring, but it has a 10-year validit
 
 ### Let's Encrypt implementation
 
-Lamaste uses certbot with the nginx plugin for certificate issuance. The implementation lives in `@lamalibre/lamaste@4.5.0/server` (`packages/core/lib/src/server/certbot.ts`), wrapped by `packages/server/daemon/src/lib/certbot.js`.
+Lamaste uses certbot with the nginx plugin for certificate issuance. The implementation lives in `@lamalibre/lamaste@4.7.0/server` (`packages/core/lib/src/server/certbot.ts`), wrapped by `packages/server/daemon/src/lib/certbot.js`.
 
 The panel runs as the unprivileged `lamaste` user and never runs `certbot` or `openssl` on Let's Encrypt files directly. It calls two root-owned wrapper scripts through sudo:
 
@@ -193,7 +193,7 @@ This three-step check prevents unnecessary certificate issuance and respects rat
 
 #### Custom-domain site certificate issuance
 
-A custom-domain static site may have redirect aliases (e.g. `www.myblog.net`). `issueSiteCert(fqdn, aliases, email)` in `@lamalibre/lamaste@4.5.0/server` keeps them on **one** lineage named after the primary domain:
+A custom-domain static site may have redirect aliases (e.g. `www.myblog.net`). `issueSiteCert(fqdn, aliases, email)` in `@lamalibre/lamaste@4.7.0/server` keeps them on **one** lineage named after the primary domain:
 
 ```bash
 sudo /usr/local/sbin/lamaste-certbot issue admin@example.com myblog.net myblog.net www.myblog.net

package/vendor/docs/01-concepts/dns-and-domains.md

@@ -260,6 +260,15 @@ Once set during onboarding, the domain is used throughout the system for constru
 | `packages/lamaste-serverd/src/lib/nginx.js`                | Vhost creation with domain-based server_name |
 | `packages/lamaste-serverd/src/lib/state.js`                | Domain storage in panel.json                 |
 
+## Multiple domains
+
+One relay can serve several base domains: the **primary** (set at onboarding — `panel.`, `tunnel.` and agent panels live there) and **added** domains, each with its own sign-in at `auth.<domain>` and its own member list. People have one account across all of them; a person reaches a domain's protected hosts only as a member, and signs in once per domain (browsers never share cookies between domains).
+
+- **DNS for an added domain:** an A record for `auth.<domain>`, and either a wildcard `*.<domain>` or one A record per hostname, all to the relay. Explicit records (apex, `www`, mail) keep precedence over a wildcard. Steps: [Adding a Second Domain](../02-guides/second-domain.md).
+- **Domains never overlap:** `a.samplepark.tr` cannot be added beside `samplepark.tr` — a domain's cookies reach every host under it.
+- **Hostnames:** a tunnel or managed site is `<label>.<domain>`, unique as a whole; the reserved labels hold on every domain; the domain of a hostname is the one it is under (never stored separately). A domain's apex and `www.` may be a custom site or an alias.
+- **Records** live in the panel's `state.db` (`domains`, `domain_members`); `panel.json` `domain` stays the primary.
+
 ## Quick Reference
 
 ### Required DNS records (onboarding)

package/vendor/docs/01-concepts/mtls.md

@@ -25,7 +25,7 @@ You encounter mTLS during two moments:
 
 ### Importing the certificate
 
-After running `npx @lamalibre/create-lamaste@4.5.0`, the installer prints something like:
+After running `npx @lamalibre/create-lamaste@4.7.0`, the installer prints something like:
 
 ```
 ╔══════════════════════════════════════════════════════════════╗
@@ -101,7 +101,7 @@ When connecting a machine to Lamaste using `lamaste-agent`, you should **not** u
 2. Click "Generate" and enter a label (e.g., `macbook-pro`)
 3. Save the displayed password — it cannot be retrieved later
 4. Download the `.p12` file
-5. Share the `.p12` file and password with the agent machine through a secure channel, then install the agent there (`npm install -g @lamalibre/lamaste-agent@4.5.0`) and run `lamaste-agent setup` (an enrollment token avoids moving the key at all — see [Agent Setup](../02-guides/agent-setup.md))
+5. Share the `.p12` file and password with the agent machine through a secure channel, then install the agent there (`npm install -g @lamalibre/lamaste-agent@4.7.0`) and run `lamaste-agent setup` (an enrollment token avoids moving the key at all — see [Agent Setup](../02-guides/agent-setup.md))
 
 Agent certificates have capability-based access. By default, a new agent can only read tunnel configuration. Admins can grant additional capabilities per-agent from the panel UI: