@lamalibre/create-lamaste 4.6.0 → 4.7.0

package/vendor/serverd/src/routes/management/sites.js

@@ -13,12 +13,18 @@ import {
   SiteError,
   withTunnelLock,
 } from '@lamalibre/lamaste/server';
+import { DomainNameSchema } from '@lamalibre/lamaste';
 import { AppError } from '../../lib/app-error.js';
 import { webSurfaceServing } from '../../lib/web-surface.js';
 import { getConfig } from '../../lib/config.js';
 import { readSites, writeSites, readTunnels, withSitesLock } from '../../lib/state.js';
 import { writeStaticSiteVhost, removeStaticSiteVhost } from '../../lib/nginx.js';
-import { updateAccessControl } from '../../lib/authelia.js';
+import {
+  activeDomainNames,
+  domainNames,
+  resolveActiveDomain,
+  syncDomainAccess,
+} from '../../lib/domains.js';
 import { issueTunnelCert, getCertPath, issueSiteCert } from '../../lib/certbot.js';
 import {
   createSiteDirectory,
@@ -57,6 +63,8 @@ const CreateSiteSchema = z.object({
   aliases: z.array(AliasSchema).max(10, 'At most 10 aliases').optional(),
   spaMode: z.boolean().optional().default(false),
   autheliaProtected: z.boolean().optional().default(false),
+  /** A managed site's domain (an active one; the primary when absent). */
+  domain: DomainNameSchema.optional(),
 });
 
 const UpdateSiteSchema = z.object({
@@ -107,8 +115,31 @@ function buildTunnelReadDeps() {
   return { readTunnels };
 }
 
-function buildAutheliaDeps() {
-  return { updateAccessControl };
+/**
+ * Authelia renders every site's protection together with the domains'
+ * members (lib/domains.js) — given the sites being saved.
+ */
+function buildAutheliaDeps(logger) {
+  return {
+    renderAccess: async (sites) => {
+      await syncDomainAccess({ logger, sites });
+    },
+  };
+}
+
+/**
+ * The active domain a managed site is put on (the primary unless named), as
+ * a SiteError the create route answers like its other refusals.
+ *
+ * @param {string | undefined} requested
+ */
+async function siteDomain(requested) {
+  try {
+    return await resolveActiveDomain(requested);
+  } catch (err) {
+    if (Number.isInteger(err.statusCode)) throw new SiteError(err.message, 'DOMAIN_NOT_CONFIGURED');
+    throw err;
+  }
 }
 
 /**
@@ -119,7 +150,6 @@ function siteErrorStatus(code) {
     case 'CUSTOM_DOMAIN_REQUIRED':
     case 'NAME_IN_USE':
     case 'RESERVED_NAME':
-    case 'NAME_TUNNEL_COLLISION':
     case 'FQDN_IN_USE':
     case 'FQDN_TUNNEL_COLLISION':
     case 'NOT_CUSTOM':
@@ -127,6 +157,7 @@ function siteErrorStatus(code) {
     case 'INVALID_ALIAS':
     case 'ALIAS_IN_USE':
     case 'DNS_MISMATCH':
+    case 'NOT_UNDER_DOMAIN':
       return 400;
     case 'NOT_FOUND':
       return 404;
@@ -227,7 +258,6 @@ export default async function sitesRoutes(fastify, _opts) {
   const filesDeps = buildFilesDeps();
   const siteStateDeps = buildSiteStateDeps();
   const tunnelReadDeps = buildTunnelReadDeps();
-  const autheliaDeps = buildAutheliaDeps();
 
   // GET /api/sites
   //
@@ -288,9 +318,15 @@ export default async function sitesRoutes(fastify, _opts) {
           error: 'Domain and email must be configured before creating sites',
         });
       }
-
+      if (body.domain !== undefined && body.type !== 'managed') {
+        return reply.code(400).send({
+          error: "A custom site's hostname names its domain — `domain` is for managed sites",
+        });
+      }
       try {
-        const result = await withHostnameLocks(() =>
+        // The domain is resolved under the hostname locks — those a domain's
+        // removal takes — so the site never lands on a removed domain.
+        const result = await withHostnameLocks(async () =>
           createSite({
             name: body.name,
             type: body.type,
@@ -298,7 +334,9 @@ export default async function sitesRoutes(fastify, _opts) {
             aliases: body.aliases,
             spaMode: body.spaMode,
             autheliaProtected: body.autheliaProtected,
-            domain: config.domain,
+            domain: await siteDomain(body.domain),
+            domains: await activeDomainNames(),
+            relayDomains: await domainNames(),
             email: config.email,
             nginx: nginxDeps,
             certbot: certbotDeps,
@@ -388,14 +426,15 @@ export default async function sitesRoutes(fastify, _opts) {
             autheliaProtected: body.autheliaProtected,
             allowedUsers: body.allowedUsers,
             aliases: body.aliases,
-            domain: config.domain,
+            domains: await activeDomainNames(),
+            relayDomains: await domainNames(),
             email: config.email,
             serverIp: config.ip,
             nginx: nginxDeps,
             certbot: certbotDeps,
             siteState: siteStateDeps,
             tunnelState: tunnelReadDeps,
-            authelia: autheliaDeps,
+            authelia: buildAutheliaDeps(request.log),
             logger: request.log,
           });
         });
@@ -444,7 +483,7 @@ export default async function sitesRoutes(fastify, _opts) {
           return verifyDns({
             id,
             serverIp: config.ip,
-            domain: config.domain,
+            domains: await activeDomainNames(),
             email: config.email,
             nginx: nginxDeps,
             certbot: certbotDeps,

package/vendor/serverd/src/routes/management/tunnels.js

@@ -22,16 +22,20 @@ import {
   updateTunnel,
   TUNNEL_MAX_BODY_MB,
   grantedTunnelsFor,
+  hostnameHolder,
   TunnelError,
 } from '@lamalibre/lamaste/server';
 import {
   AGENT_LABEL_REGEX,
+  DomainNameSchema,
   INTERNAL_PLUGIN_PORT_RANGE,
   PLUGIN_AGENT_CN_PREFIX,
   RESERVED_TUNNEL_PORTS,
   isInternalPluginPort,
 } from '@lamalibre/lamaste';
 import { getConfig } from '../../lib/config.js';
+import { primaryDomainName, resolveActiveDomain } from '../../lib/domains.js';
+import { sendFailure } from '../../lib/app-error.js';
 import { readTunnels, readSites } from '../../lib/state.js';
 import { getAgentHostFactsHash, loadAgentRegistry } from '../../lib/mtls.js';
 import { getChiselCredentialIssuedAt } from '../../lib/chisel-users.js';
@@ -147,6 +151,9 @@ const CreateTunnelSchema = z
     agentLabel: AgentLabelSchema.optional(),
     accessMode: AccessModeSchema.optional().default('restricted'),
     maxBodySizeMb: MaxBodySizeSchema.optional(),
+    // The base domain the hostname is under (an active one; the primary
+    // when absent). An agent panel is always on the primary.
+    domain: DomainNameSchema.optional(),
   })
   .refine((d) => d.type !== 'plugin' || (d.pluginName && d.agentLabel), {
     message: 'pluginName and agentLabel are required for plugin tunnels',
@@ -227,9 +234,8 @@ function maxBodyCeiling(request) {
  * every workflow giving a site a hostname holds too.
  */
 async function siteServing(fqdn) {
-  const sites = await readSites();
-  const site = sites.find((s) => s.fqdn === fqdn || (s.aliases ?? []).includes(fqdn));
-  return site ? `by a static site ('${site.name}')` : null;
+  const holder = hostnameHolder(fqdn, { sites: await readSites() });
+  return holder ? `by a static site ('${holder.name}')` : null;
 }
 
 /**
@@ -342,6 +348,7 @@ export default async function tunnelRoutes(fastify, _opts) {
           tunnels: carried.map((t) => ({
             port: t.port,
             subdomain: t.subdomain,
+            fqdn: t.fqdn,
           })),
           // The agent-hosted plugins this agent hosts: the agent fetches a
           // plugin's config when it does not hold the secret issued at
@@ -501,6 +508,17 @@ export default async function tunnelRoutes(fastify, _opts) {
           error: 'Domain and email must be configured before creating tunnels',
         });
       }
+      let domain;
+      try {
+        domain = await resolveActiveDomain(body.domain);
+      } catch (err) {
+        return sendFailure(request, reply, err, 'Failed to read the domains');
+      }
+      if (type === 'panel' && domain !== (await primaryDomainName())) {
+        return reply
+          .code(400)
+          .send({ error: 'An agent panel is served on the primary domain only' });
+      }
 
       try {
         const tunnel = await createTunnel({
@@ -512,7 +530,11 @@ export default async function tunnelRoutes(fastify, _opts) {
           pluginName,
           agentLabel,
           maxBodySizeMb,
-          domain: config.domain,
+          domain,
+          // Under the tunnel lock: the domain may have been removed since.
+          assertDomainActive: async (d) => {
+            await resolveActiveDomain(d);
+          },
           email: config.email,
           nginx: nginxDeps,
           certbot: certbotDeps,
@@ -524,6 +546,9 @@ export default async function tunnelRoutes(fastify, _opts) {
         });
         return reply.code(201).send({ ok: true, tunnel });
       } catch (err) {
+        if (Number.isInteger(err.statusCode)) {
+          return sendFailure(request, reply, err, 'Failed to create tunnel');
+        }
         if (err instanceof TunnelError) {
           const status = tunnelErrorStatus(err.code);
           return reply.code(status).send({
@@ -589,7 +614,6 @@ export default async function tunnelRoutes(fastify, _opts) {
           agentLabel: body.agentLabel,
           accessMode: body.accessMode,
           maxBodySizeMb: body.maxBodySizeMb,
-          domain: config.domain,
           email: config.email,
           nginx: nginxDeps,
           certbot: certbotDeps,

package/vendor/serverd/src/routes/management/users.js

@@ -1,5 +1,10 @@
 import { z } from 'zod';
-import { USERNAME_MAX_LENGTH, USERNAME_MIN_LENGTH, USERNAME_REGEX } from '@lamalibre/lamaste';
+import {
+  USERNAME_MAX_LENGTH,
+  USERNAME_MIN_LENGTH,
+  USERNAME_REGEX,
+  isLamasteOwnedGroup,
+} from '@lamalibre/lamaste';
 import {
   readUsers,
   readUsersRaw,
@@ -9,7 +14,7 @@ import {
   writeTotpToDatabase,
 } from '../../lib/authelia.js';
 import { revokeUserRegistryTokens } from '../../lib/registry-credential.js';
-import { httpError } from '../../lib/app-error.js';
+import { httpError, sendFailure } from '../../lib/app-error.js';
 import { actorFromRequest } from '../../lib/actor.js';
 import { recordAuditBestEffort } from '../../lib/audit.js';
 import {
@@ -21,6 +26,19 @@ import {
   getDirectoryUser,
   usersFileError,
 } from '../../lib/directory.js';
+import {
+  MembershipInputSchema,
+  adminGroups,
+  adminGroupsOf,
+  assertAssignableGroups,
+  domainNames,
+  domainsByUser,
+  domainsForNewUser,
+  domainsOfUser,
+  externalMemberGroupsError,
+  normalizeMemberships,
+  setUserDomains,
+} from '../../lib/domains.js';
 
 const CreateUserSchema = z.object({
   username: z
@@ -34,7 +52,11 @@ const CreateUserSchema = z.object({
   displayname: z.string().min(1).max(100),
   email: z.string().email(),
   password: z.string().min(8).max(128),
-  groups: z.array(z.string()).optional().default([]),
+  groups: z.array(z.string()).max(100).optional().default([]),
+  // The domains the user is a member of — a name (a member) or
+  // `{ name, kind }` — required while the relay has two or more; with one,
+  // the user becomes its member.
+  domains: z.array(MembershipInputSchema).max(50).optional(),
 });
 
 const UsernameParamSchema = z.object({
@@ -50,10 +72,14 @@ const UpdateUserSchema = z
     displayname: z.string().min(1).max(100).optional(),
     email: z.string().email().optional(),
     password: z.string().min(8).max(128).optional(),
-    groups: z.array(z.string()).optional(),
+    groups: z.array(z.string()).max(100).optional(),
     // Authelia's `disabled: true`: the user cannot sign in, every plugin
     // audience shows them disabled, and the user surface refuses them.
     disabled: z.boolean().optional(),
+    // The domains the user is a member of afterwards — exactly these (the
+    // difference applied in one transaction, each membership audited): a
+    // name (a member) or `{ name, kind }`.
+    domains: z.array(MembershipInputSchema).max(50).optional(),
   })
   .refine((data) => Object.keys(data).length > 0, {
     message: 'At least one field must be provided',
@@ -76,17 +102,28 @@ async function readUsersOrFail() {
   }
 }
 
-async function writeUsersOrFail(usersData) {
+async function writeUsersOrFail(usersData, opts) {
   try {
-    await writeUsers(usersData);
+    await writeUsers(usersData, opts);
   } catch (err) {
     throw httpError('Failed to update user database', 500, { cause: err });
   }
 }
 
-/** The user's groups as a sorted list (users.yml may hold none). */
-function groupsOf(entry) {
-  return Array.isArray(entry?.groups) ? [...entry.groups].sort() : [];
+/**
+ * The groups an administrator gave a user as a sorted list — the groups
+ * Lamaste owns left out (users.yml may hold none). `domains`: every domain
+ * record.
+ */
+function groupsOf(entry, domains) {
+  return adminGroups(entry?.groups, domains).sort();
+}
+
+/** The groups Lamaste owns that a users.yml entry holds — kept by every edit. */
+function ownedGroupsOf(entry, domains) {
+  return Array.isArray(entry?.groups)
+    ? entry.groups.filter((g) => isLamasteOwnedGroup(g, domains))
+    : [];
 }
 
 /** Whether two lists hold the same strings. */
@@ -101,22 +138,6 @@ function isEnabledAdmin(entry) {
   );
 }
 
-/**
- * Answer a refusal a users change threw (an error with `statusCode`: its
- * message and `code`), or a 500 for anything else — logged either way when
- * it is the panel's own failure.
- */
-function sendFailure(request, reply, err, fallback) {
-  if (Number.isInteger(err.statusCode)) {
-    if (err.statusCode >= 500) request.log.error(err.cause ?? err, err.message);
-    return reply
-      .code(err.statusCode)
-      .send({ error: err.message, ...(err.code ? { code: err.code } : {}) });
-  }
-  request.log.error(err, fallback);
-  return reply.code(500).send({ error: fallback });
-}
-
 export default async function usersRoutes(fastify, _opts) {
   // GET /api/users — list all users (no sensitive fields): users.yml's, with
   // each one's directory id (null until the directory has seen them, within
@@ -130,13 +151,17 @@ export default async function usersRoutes(fastify, _opts) {
       try {
         const users = await readUsers();
         const directory = await directoryUsersByUsername();
+        const memberships = await domainsByUser();
+        const domains = await domainNames();
         const listed = users
           .map((user) => {
             const known = directory.get(user.username);
             return {
               ...user,
+              groups: groupsOf(user, domains),
               userId: known?.userId ?? null,
               status: known?.status ?? (user.disabled ? 'disabled' : 'active'),
+              domains: (known && memberships.get(known.userId)) ?? [],
             };
           })
           .sort((a, b) => a.username.localeCompare(b.username));
@@ -160,6 +185,17 @@ export default async function usersRoutes(fastify, _opts) {
     async (request, reply) => {
       const body = CreateUserSchema.parse(request.body);
 
+      let domains;
+      try {
+        assertAssignableGroups(body.groups);
+        domains = await domainsForNewUser(body.domains, { required: true });
+        if (body.groups.length > 0 && domains.some((m) => m.kind === 'external')) {
+          throw externalMemberGroupsError(400);
+        }
+      } catch (err) {
+        return sendFailure(request, reply, err, 'Failed to read the domains');
+      }
+
       try {
         // Refused before a password is hashed; checked again under the lock.
         if ((await readUsersOrFail()).users[body.username]) {
@@ -198,6 +234,7 @@ export default async function usersRoutes(fastify, _opts) {
             // A removed user's grants, groups and second factors under the
             // username go first; a username with an OIDC identity is refused.
             creates: [body.username],
+            domains: { [body.username]: domains },
             expect: (users) => users[body.username]?.password === hash,
           },
         ));
@@ -217,6 +254,7 @@ export default async function usersRoutes(fastify, _opts) {
           disabled: false,
           userId: created?.userId ?? null,
           status: 'active',
+          domains: created ? await domainsOfUser(created.userId) : [],
         },
         ...(warnings.length > 0 ? { warnings } : {}),
       });
@@ -248,68 +286,149 @@ export default async function usersRoutes(fastify, _opts) {
         }
       }
 
+      const domains = await domainNames();
+
       /** Whether users.yml's entry holds every field this request set. */
       const intended = (entry) =>
         entry !== undefined &&
         entry !== null &&
         (body.displayname === undefined || entry.displayname === body.displayname) &&
         (body.email === undefined || entry.email === body.email) &&
-        (body.groups === undefined || sameList(groupsOf(entry), [...body.groups].sort())) &&
+        (body.groups === undefined ||
+          sameList(groupsOf(entry, domains), [...body.groups].sort())) &&
         (passwordHash === undefined || entry.password === passwordHash) &&
         (body.disabled === undefined || (entry.disabled === true) === body.disabled);
 
+      const { domains: memberOf, ...fields } = body;
+      const memberships = memberOf === undefined ? undefined : normalizeMemberships(memberOf);
+      const known = await findDirectoryUser(username);
+      const userId = known?.userId ?? null;
+      if (memberships !== undefined && !userId) {
+        return reply.code(409).send({
+          error: 'The directory has not seen this user yet — try again within a minute',
+          code: 'user_not_in_directory',
+        });
+      }
+      const current = userId ? await domainsOfUser(userId) : [];
+      const external = (memberships ?? current).some((m) => m.kind === 'external');
+      // Refused before anything is written: groups kept or given to a user
+      // who is (or becomes) an external member. Checked again under the
+      // users lock, by each step.
+      if (external) {
+        let groups = body.groups;
+        if (groups === undefined) {
+          try {
+            groups = await adminGroupsOf(username);
+          } catch (err) {
+            return sendFailure(request, reply, err, 'Failed to read user database');
+          }
+        }
+        if (groups.length > 0) {
+          return sendFailure(request, reply, externalMemberGroupsError(409), 'Refused');
+        }
+      }
+      // A user leaving every external membership with groups given in the
+      // same request: the memberships first, then the groups (each step is
+      // checked against the other under the users lock).
+      const membershipsFirst =
+        memberships !== undefined && !external && current.some((m) => m.kind === 'external');
+
+      const warnings = [];
+      const changeMemberships = async () => {
+        if (memberships === undefined) return;
+        const membership = await setUserDomains(userId, memberships, {
+          actor: actorFromRequest(request),
+          logger: request.log,
+        });
+        warnings.push(...(membership.warnings ?? []));
+      };
+      if (membershipsFirst) {
+        try {
+          await changeMemberships();
+        } catch (err) {
+          return sendFailure(request, reply, err, 'Failed to change the memberships');
+        }
+      }
+
       let outcome;
       let before = null;
       try {
-        outcome = await changeUsers(
-          async () => {
-            const usersData = await readUsersOrFail();
-            const user = usersData.users[username];
-            if (!user) throw httpError('User not found', 404);
-            // As it was before this request (a second attempt finds it changed already).
-            before ??= { groups: groupsOf(user), disabled: user.disabled === true };
-            if (body.disabled === true && isEnabledAdmin(user)) {
-              const enabledAdmins = Object.values(usersData.users).filter(isEnabledAdmin).length;
-              if (enabledAdmins <= 1) {
-                throw httpError('Cannot disable the last enabled administrator', 400, {
-                  code: 'last_admin',
-                });
+        // Only memberships change: users.yml is not written, the user is read.
+        if (Object.keys(fields).length === 0) {
+          const usersData = await readUsersOrFail();
+          const user = usersData.users[username];
+          if (!user) throw httpError('User not found', 404);
+          before = { groups: groupsOf(user, domains), disabled: user.disabled === true };
+          outcome = { result: user, warnings: [], persisted: true };
+        } else
+          outcome = await changeUsers(
+            async () => {
+              const usersData = await readUsersOrFail();
+              const user = usersData.users[username];
+              if (!user) throw httpError('User not found', 404);
+              // As it was before this request (a second attempt finds it changed already).
+              before ??= { groups: groupsOf(user, domains), disabled: user.disabled === true };
+              if (body.groups !== undefined) {
+                assertAssignableGroups(body.groups, before.groups);
+                // Checked under the users lock, which a change of kind takes too.
+                if (
+                  body.groups.length > 0 &&
+                  userId &&
+                  (await domainsOfUser(userId)).some((m) => m.kind === 'external')
+                ) {
+                  throw externalMemberGroupsError(409);
+                }
+              }
+              if (body.disabled === true && isEnabledAdmin(user)) {
+                const enabledAdmins = Object.values(usersData.users).filter(isEnabledAdmin).length;
+                if (enabledAdmins <= 1) {
+                  throw httpError('Cannot disable the last enabled administrator', 400, {
+                    code: 'last_admin',
+                  });
+                }
               }
-            }
-
-            if (body.displayname !== undefined) user.displayname = body.displayname;
-            if (body.email !== undefined) user.email = body.email;
-            if (body.groups !== undefined) user.groups = body.groups;
-            if (passwordHash !== undefined) user.password = passwordHash;
-            if (body.disabled === true) user.disabled = true;
-            if (body.disabled === false) delete user.disabled;
 
-            await writeUsersOrFail(usersData);
-            return user;
-          },
-          {
-            actor: actorFromRequest(request),
-            logger: request.log,
-            // Authelia's own password reset may rewrite users.yml under the
-            // change: it is checked after the restart, and made once more.
-            expect: (users) => intended(users[username]),
-          },
-        );
+              if (body.displayname !== undefined) user.displayname = body.displayname;
+              if (body.email !== undefined) user.email = body.email;
+              if (body.groups !== undefined) {
+                user.groups = [...body.groups, ...ownedGroupsOf(user, domains)];
+              }
+              if (passwordHash !== undefined) user.password = passwordHash;
+              if (body.disabled === true) user.disabled = true;
+              if (body.disabled === false) delete user.disabled;
+
+              await writeUsersOrFail(usersData);
+              return user;
+            },
+            {
+              actor: actorFromRequest(request),
+              logger: request.log,
+              // Authelia's own password reset may rewrite users.yml under the
+              // change: it is checked after the rendering, and made once more.
+              expect: (users) => intended(users[username]),
+            },
+          );
       } catch (err) {
         return sendFailure(request, reply, err, 'Failed to update user database');
       }
 
       const user = outcome.result;
       const disabled = user.disabled === true;
-      const warnings = [...outcome.warnings];
-      const known = await findDirectoryUser(username);
-      const userId = known?.userId ?? null;
+      warnings.push(...outcome.warnings);
+
+      if (!membershipsFirst) {
+        try {
+          await changeMemberships();
+        } catch (err) {
+          return sendFailure(request, reply, err, 'Failed to change the memberships');
+        }
+      }
 
       // Disabling is offboarding, which the change did as the directory saw
       // the user become disabled (`changeUsers`): sessions ended, registry
       // tokens revoked. Registry scopes are granted at login from feria-*
       // groups too: losing one must not leave a valid token behind either.
-      const groupsAfter = groupsOf(user);
+      const groupsAfter = groupsOf(user, domains);
       const groupsChanged = body.groups !== undefined && !sameList(before.groups, groupsAfter);
       if (groupsChanged && !(disabled && !before.disabled)) {
         try {
@@ -348,10 +467,11 @@ export default async function usersRoutes(fastify, _opts) {
           username,
           displayname: user.displayname,
           email: user.email,
-          groups: user.groups || [],
+          groups: groupsAfter,
           disabled,
           userId,
           status: disabled ? 'disabled' : 'active',
+          domains: userId ? await domainsOfUser(userId) : [],
         },
         ...(outcome.persisted ? {} : { persisted: false }),
         ...(warnings.length > 0 ? { warnings } : {}),
@@ -386,7 +506,7 @@ export default async function usersRoutes(fastify, _opts) {
               throw httpError('Cannot delete the last user', 400);
             }
             delete usersData.users[username];
-            await writeUsersOrFail(usersData);
+            await writeUsersOrFail(usersData, { deleting: [username] });
           },
           {
             actor,

package/vendor/serverd/src/routes/management.js

@@ -20,6 +20,7 @@ import agentsRoutes from './management/agents.js';
 import registryCredentialRoutes from './management/registry-credential.js';
 import auditRoutes from './management/audit.js';
 import agentPanelAuthzRoutes from './management/agent-panel-authz.js';
+import domainRoutes from './management/domains.js';
 
 export default async function managementRoutes(fastify, _opts) {
   fastify.addHook('onRequest', managementOnly());
@@ -45,4 +46,5 @@ export default async function managementRoutes(fastify, _opts) {
   await fastify.register(registryCredentialRoutes);
   await fastify.register(auditRoutes);
   await fastify.register(agentPanelAuthzRoutes);
+  await fastify.register(domainRoutes);
 }

package/vendor/serverd/src/routes/onboarding/dns.js

@@ -1,21 +1,7 @@
-import dns from 'node:dns/promises';
-import { CORE_SUBDOMAINS } from '@lamalibre/lamaste';
+import { CORE_SUBDOMAINS, DNS_WILDCARD_PROBE_LABEL } from '@lamalibre/lamaste';
+import { resolveHostA as resolveA } from '@lamalibre/lamaste/server';
 import { getConfig, updateConfig } from '../../lib/config.js';
 
-/**
- * Resolve A records for a hostname, returning an empty array on expected DNS errors.
- */
-async function resolveA(hostname) {
-  try {
-    return await dns.resolve4(hostname);
-  } catch (err) {
-    if (err.code === 'ENOTFOUND' || err.code === 'ENODATA' || err.code === 'ETIMEOUT') {
-      return [];
-    }
-    throw err;
-  }
-}
-
 /**
  * Build a human-readable diagnostic message for the DNS verification result.
  */
@@ -69,7 +55,7 @@ export default async function dnsRoute(fastify, _opts) {
     const [coreResolved, apexResolvedIps, wildcardResolvedIps] = await Promise.all([
       Promise.all(coreNames.map((name) => resolveA(name))),
       resolveA(domain),
-      resolveA(`test-lamaste-check.${domain}`),
+      resolveA(`${DNS_WILDCARD_PROBE_LABEL}.${domain}`),
     ]);
 
     const records = coreNames.map((name, i) => {