@lamalibre/create-portlama 1.0.2 → 1.0.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamalibre/create-portlama",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "One-command setup for secure reverse tunnels with a management dashboard",
   "type": "module",
   "license": "MIT",

package/src/index.js

@@ -11,6 +11,7 @@ import { nodeTasks } from './tasks/node.js';
 import { mtlsTasks } from './tasks/mtls.js';
 import { nginxTasks } from './tasks/nginx.js';
 import { panelTasks } from './tasks/panel.js';
+import { redeployTasks } from './tasks/redeploy.js';
 
 /**
  * Parse minimal CLI flags from process.argv.
@@ -24,6 +25,7 @@ function parseFlags() {
     dev: args.includes('--dev'),
     help: args.includes('--help') || args.includes('-h'),
     yes: args.includes('--yes') || args.includes('-y'),
+    forceFull: args.includes('--force-full'),
   };
 }
 
@@ -92,6 +94,7 @@ ${b('FLAGS')}
   ${c('--yes')}, ${c('-y')}          Skip the confirmation prompt
   ${c('--skip-harden')}       Skip OS hardening (swap, UFW, fail2ban, SSH)
   ${c('--dev')}               Allow private/non-routable IP addresses
+  ${c('--force-full')}        Run full installation even on existing installs
   ${c('--uninstall')}         Show manual removal guide for Portlama
 `);
   process.exit(0);
@@ -266,10 +269,33 @@ async function detectExistingState() {
 /**
  * Print a confirmation banner and optionally wait for user input.
  * @param {{ yes: boolean }} flags - Parsed CLI flags.
+ * @param {boolean} isRedeploy - Whether we are in redeploy mode.
  * @param {{ portlamaExists: boolean, onboardingStatus: string | null, existingNginxSites: string[], port3100InUse: boolean, ufwActive: boolean, ufwRuleCount: number }} existingState - Detection results.
  */
-async function confirmInstallation(flags, existingState) {
-  const banner = `
+async function confirmInstallation(flags, isRedeploy, existingState) {
+  let banner;
+
+  if (isRedeploy) {
+    banner = `
+${chalk.cyan.bold('┌─────────────────────────────────────────────────────────────┐')}
+${chalk.cyan.bold('│')}  ${chalk.white.bold('Portlama Panel Update')}                                       ${chalk.cyan.bold('│')}
+${chalk.cyan.bold('├─────────────────────────────────────────────────────────────┤')}
+${chalk.cyan.bold('│')}                                                             ${chalk.cyan.bold('│')}
+${chalk.cyan.bold('│')}  Existing installation detected. Updating panel only.       ${chalk.cyan.bold('│')}
+${chalk.cyan.bold('│')}                                                             ${chalk.cyan.bold('│')}
+${chalk.cyan.bold('│')}  The following changes will be made:                         ${chalk.cyan.bold('│')}
+${chalk.cyan.bold('│')}                                                             ${chalk.cyan.bold('│')}
+${chalk.cyan.bold('│')}    ${chalk.yellow('•')} Stop panel service                                    ${chalk.cyan.bold('│')}
+${chalk.cyan.bold('│')}    ${chalk.yellow('•')} Update panel-server and panel-client files             ${chalk.cyan.bold('│')}
+${chalk.cyan.bold('│')}    ${chalk.yellow('•')} Install updated dependencies                           ${chalk.cyan.bold('│')}
+${chalk.cyan.bold('│')}    ${chalk.yellow('•')} Restart panel service                                  ${chalk.cyan.bold('│')}
+${chalk.cyan.bold('│')}                                                             ${chalk.cyan.bold('│')}
+${chalk.cyan.bold('│')}  ${chalk.dim('OS, nginx, mTLS certs, and firewall are untouched.')}        ${chalk.cyan.bold('│')}
+${chalk.cyan.bold('│')}  ${chalk.dim('Use --force-full to run the complete installer.')}           ${chalk.cyan.bold('│')}
+${chalk.cyan.bold('│')}                                                             ${chalk.cyan.bold('│')}
+${chalk.cyan.bold('└─────────────────────────────────────────────────────────────┘')}`;
+  } else {
+    banner = `
 ${chalk.cyan.bold('┌─────────────────────────────────────────────────────────────┐')}
 ${chalk.cyan.bold('│')}  ${chalk.white.bold('Portlama Installer')}                                          ${chalk.cyan.bold('│')}
 ${chalk.cyan.bold('├─────────────────────────────────────────────────────────────┤')}
@@ -288,39 +314,42 @@ ${chalk.cyan.bold('│')}
 ${chalk.cyan.bold('│')}  ${chalk.dim('Designed for a fresh Ubuntu 24.04 droplet.')}                  ${chalk.cyan.bold('│')}
 ${chalk.cyan.bold('│')}                                                             ${chalk.cyan.bold('│')}
 ${chalk.cyan.bold('└─────────────────────────────────────────────────────────────┘')}`;
+  }
 
   console.log(banner);
 
-  // Display detection warnings below the banner
-  const warnings = [];
+  // Display detection warnings below the banner (only for full install)
+  if (!isRedeploy) {
+    const warnings = [];
 
-  if (existingState.portlamaExists) {
-    const status = existingState.onboardingStatus || 'UNKNOWN';
-    warnings.push(
-      `An existing Portlama installation was detected (onboarding: ${status}). Re-running will update the installation but preserve your configuration.`,
-    );
-  }
+    if (existingState.portlamaExists) {
+      const status = existingState.onboardingStatus || 'UNKNOWN';
+      warnings.push(
+        `An existing Portlama installation was detected (onboarding: ${status}). Re-running will update the installation but preserve your configuration.`,
+      );
+    }
 
-  if (existingState.existingNginxSites.length > 0) {
-    warnings.push(
-      `Existing nginx sites will be affected: ${existingState.existingNginxSites.join(', ')}`,
-    );
-  }
+    if (existingState.existingNginxSites.length > 0) {
+      warnings.push(
+        `Existing nginx sites will be affected: ${existingState.existingNginxSites.join(', ')}`,
+      );
+    }
 
-  if (existingState.port3100InUse) {
-    warnings.push('Port 3100 is currently in use. The panel may fail to start.');
-  }
+    if (existingState.port3100InUse) {
+      warnings.push('Port 3100 is currently in use. The panel may fail to start.');
+    }
 
-  if (existingState.ufwActive && existingState.ufwRuleCount > 0) {
-    warnings.push(
-      `Existing UFW firewall rules (${existingState.ufwRuleCount} rules) will be reset.`,
-    );
-  }
+    if (existingState.ufwActive && existingState.ufwRuleCount > 0) {
+      warnings.push(
+        `Existing UFW firewall rules (${existingState.ufwRuleCount} rules) will be reset.`,
+      );
+    }
 
-  if (warnings.length > 0) {
-    console.log('');
-    for (const warning of warnings) {
-      console.log(`  ${chalk.yellow('!')} ${chalk.yellow(warning)}`);
+    if (warnings.length > 0) {
+      console.log('');
+      for (const warning of warnings) {
+        console.log(`  ${chalk.yellow('!')} ${chalk.yellow(warning)}`);
+      }
     }
   }
 
@@ -461,11 +490,32 @@ export async function main() {
     // Detect existing system state for the confirmation banner
     const existingState = await detectExistingState();
 
-    // Show confirmation banner and wait for user input
-    await confirmInstallation(flags, existingState);
+    // Determine mode: redeploy (fast update) or full install
+    const isRedeploy = existingState.portlamaExists && !flags.forceFull;
 
-    // Run installation tasks
-    await installTasks.run();
+    // Show confirmation banner and wait for user input
+    await confirmInstallation(flags, isRedeploy, existingState);
+
+    if (isRedeploy) {
+      // Fast path: only update panel files and restart
+      const redeployTaskList = new Listr(
+        [
+          {
+            title: 'Redeploying Portlama panel',
+            task: (_ctx, task) => redeployTasks(ctx, task),
+          },
+        ],
+        {
+          renderer: 'default',
+          rendererOptions: { collapseSubtasks: false },
+          exitOnError: true,
+        },
+      );
+      await redeployTaskList.run();
+    } else {
+      // Full install path
+      await installTasks.run();
+    }
   } catch (error) {
     console.error('\n');
     console.error('  ┌─────────────────────────────────────────────┐');

package/src/lib/summary.js

@@ -1,21 +1,88 @@
 import { readFile } from 'node:fs/promises';
 import chalk from 'chalk';
 
+// eslint-disable-next-line no-control-regex
+const ansiPattern = new RegExp('\x1b\\[[0-9;]*m', 'g');
+const stripAnsi = (str) => str.replace(ansiPattern, '');
+
+/**
+ * Print an array of lines inside a bordered box with a title separator
+ * after the first 3 lines.
+ * @param {string[]} lines
+ */
+function printBox(lines) {
+  const maxLineWidth = Math.max(...lines.map((l) => stripAnsi(l).length));
+  const boxInnerWidth = Math.max(maxLineWidth + 2, 62);
+
+  const border = chalk.cyan;
+  const topBorder = border(`╔${'═'.repeat(boxInnerWidth)}╗`);
+  const bottomBorder = border(`╚${'═'.repeat(boxInnerWidth)}╝`);
+  const midBorder = border(`╠${'═'.repeat(boxInnerWidth)}╣`);
+
+  const padLine = (line) => {
+    const visibleLength = stripAnsi(line).length;
+    const padding = boxInnerWidth - visibleLength;
+    return `${border('║')}${line}${' '.repeat(Math.max(0, padding))}${border('║')}`;
+  };
+
+  console.log('');
+  console.log(topBorder);
+
+  // Title section (first 3 lines: empty, title, empty)
+  for (let i = 0; i < 3; i++) {
+    console.log(padLine(lines[i]));
+  }
+
+  // Separator
+  console.log(midBorder);
+
+  // Remaining content lines
+  for (let i = 3; i < lines.length; i++) {
+    console.log(padLine(lines[i]));
+  }
+
+  console.log(bottomBorder);
+  console.log('');
+}
+
 /**
  * Print the post-install summary box with all the information the user needs
  * to download their client certificate, import it, and access the panel.
  *
- * @param {{ ip: string, pkiDir: string }} ctx - Shared installer context.
+ * In redeploy mode, prints a shorter summary since the user already has
+ * their certificate and knows how to access the panel.
+ *
+ * @param {{ ip: string, pkiDir: string, installedVersion?: string, vendorVersion?: string }} ctx - Shared installer context.
  */
 export async function printSummary(ctx) {
+  const ip = ctx.ip;
+  const panelUrl = `https://${ip}:9292`;
+
+  // Redeploy mode: short summary
+  if (ctx.installedVersion !== undefined) {
+    const lines = [
+      '',
+      `   ${chalk.green.bold('Panel updated successfully!')}`,
+      '',
+      `   ${chalk.white.bold('Version:')} ${chalk.dim(ctx.installedVersion || 'unknown')} ${chalk.white('→')} ${chalk.cyan(ctx.vendorVersion || 'unknown')}`,
+      '',
+      `   ${chalk.white.bold('Panel:')}   ${chalk.cyan.underline(panelUrl)}`,
+      '',
+      `   ${chalk.dim('Your certificates, nginx config, and OS settings are unchanged.')}`,
+      `   ${chalk.dim('Refresh your browser to see the updated panel.')}`,
+      '',
+    ];
+
+    printBox(lines);
+    return;
+  }
+
+  // Full install mode: complete summary with certificate instructions
   const p12PasswordFile = `${ctx.pkiDir}/.p12-password`;
   const p12Password = (await readFile(p12PasswordFile, 'utf8')).trim();
 
-  const ip = ctx.ip;
   const scpCmd = `scp root@${ip}:${ctx.pkiDir}/client.p12 .`;
-  const panelUrl = `https://${ip}:9292`;
 
-  // Build content lines (without border)
   const lines = [
     '',
     `   ${chalk.green.bold('Portlama installed successfully!')}`,
@@ -55,47 +122,5 @@ export async function printSummary(ctx) {
     '',
   ];
 
-  // Calculate the box width based on the longest visible-content line.
-  // We strip ANSI codes to measure actual character width.
-  // eslint-disable-next-line no-control-regex
-  const ansiPattern = new RegExp('\x1b\\[[0-9;]*m', 'g');
-  const stripAnsi = (str) => str.replace(ansiPattern, '');
-  const maxLineWidth = Math.max(...lines.map((l) => stripAnsi(l).length));
-  const boxInnerWidth = Math.max(maxLineWidth + 2, 62);
-
-  const border = chalk.cyan;
-  const topBorder = border(
-    `╔${'═'.repeat(boxInnerWidth)}╗`,
-  );
-  const bottomBorder = border(
-    `╚${'═'.repeat(boxInnerWidth)}╝`,
-  );
-  const midBorder = border(
-    `╠${'═'.repeat(boxInnerWidth)}╣`,
-  );
-
-  const padLine = (line) => {
-    const visibleLength = stripAnsi(line).length;
-    const padding = boxInnerWidth - visibleLength;
-    return `${border('║')}${line}${' '.repeat(Math.max(0, padding))}${border('║')}`;
-  };
-
-  console.log('');
-  console.log(topBorder);
-
-  // Title section (first 3 lines: empty, title, empty)
-  for (let i = 0; i < 3; i++) {
-    console.log(padLine(lines[i]));
-  }
-
-  // Separator
-  console.log(midBorder);
-
-  // Remaining content lines
-  for (let i = 3; i < lines.length; i++) {
-    console.log(padLine(lines[i]));
-  }
-
-  console.log(bottomBorder);
-  console.log('');
+  printBox(lines);
 }

package/src/tasks/panel.js

@@ -239,10 +239,11 @@ StandardError=journal
 SyslogIdentifier=portlama-panel
 
 # Security hardening
-NoNewPrivileges=true
-ProtectSystem=strict
+# Note: NoNewPrivileges is intentionally omitted — the panel needs sudo
+# for provisioning (Chisel, Authelia, certbot, nginx, systemctl).
+# Access is restricted via fine-grained sudoers rules in /etc/sudoers.d/portlama.
 ProtectHome=true
-ReadWritePaths=${configDir}
+ReadWritePaths=${configDir} /var/www/portlama
 PrivateTmp=true
 
 [Install]

package/src/tasks/redeploy.js

@@ -0,0 +1,236 @@
+import { execa } from 'execa';
+import { writeFile, readFile, cp, rm } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { setTimeout as sleep } from 'node:timers/promises';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+/**
+ * Read the installed panel-server's package.json version, or null if not found.
+ * @param {string} installDir
+ * @returns {Promise<string | null>}
+ */
+async function getInstalledVersion(installDir) {
+  try {
+    const pkgPath = join(installDir, 'panel-server', 'package.json');
+    const raw = await readFile(pkgPath, 'utf8');
+    return JSON.parse(raw).version || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Read the vendor (new) panel-server's package.json version.
+ * @param {string} vendorDir
+ * @returns {Promise<string | null>}
+ */
+async function getVendorVersion(vendorDir) {
+  try {
+    const pkgPath = join(vendorDir, 'panel-server', 'package.json');
+    const raw = await readFile(pkgPath, 'utf8');
+    return JSON.parse(raw).version || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Panel redeployment subtasks. Only updates panel-server and panel-client files,
+ * runs npm install, merges config, and restarts the service. Does not touch
+ * OS hardening, mTLS certs, nginx, or any other system configuration.
+ *
+ * @param {object} ctx  Shared installer context.
+ * @param {object} task Parent Listr2 task reference.
+ * @returns {import('listr2').ListrTask[]}
+ */
+export function redeployTasks(ctx, task) {
+  const installDir = ctx.installDir;
+  const configDir = ctx.configDir;
+
+  const thisFile = fileURLToPath(import.meta.url);
+  const thisDir = dirname(thisFile);
+  const packageRoot = join(thisDir, '..', '..');
+  const vendorDir = join(packageRoot, 'vendor');
+
+  return task.newListr([
+    {
+      title: 'Checking versions',
+      task: async (_ctx, subtask) => {
+        const installed = await getInstalledVersion(installDir);
+        const vendor = await getVendorVersion(vendorDir);
+        ctx.installedVersion = installed;
+        ctx.vendorVersion = vendor;
+        subtask.output = `Installed: ${installed || 'unknown'} → New: ${vendor || 'unknown'}`;
+      },
+      rendererOptions: { persistentOutput: true },
+    },
+    {
+      title: 'Stopping panel service',
+      task: async (_ctx, subtask) => {
+        try {
+          const { stdout: status } = await execa('systemctl', [
+            'is-active',
+            'portlama-panel',
+          ]);
+          if (status.trim() === 'active') {
+            await execa('systemctl', ['stop', 'portlama-panel']);
+            subtask.output = 'Service stopped';
+          } else {
+            subtask.output = `Service was not running (${status.trim()})`;
+          }
+        } catch {
+          subtask.output = 'Service was not running';
+        }
+      },
+      rendererOptions: { persistentOutput: true },
+    },
+    {
+      title: 'Updating panel-server',
+      task: async (_ctx, subtask) => {
+        const serverSrc = join(vendorDir, 'panel-server');
+        const serverDest = join(installDir, 'panel-server');
+
+        if (!existsSync(serverSrc)) {
+          throw new Error(
+            `Panel server source not found at ${serverSrc}. Ensure the package is intact.`,
+          );
+        }
+
+        subtask.output = 'Copying panel-server files...';
+        await cp(join(serverSrc, 'package.json'), join(serverDest, 'package.json'));
+        await cp(join(serverSrc, 'src'), join(serverDest, 'src'), {
+          recursive: true,
+        });
+
+        subtask.output = 'Installing production dependencies...';
+        try {
+          await execa('npm', ['install', '--production'], {
+            cwd: serverDest,
+          });
+        } catch (err) {
+          throw new Error(
+            `Failed to install panel-server dependencies.\n${err.stderr || err.message}`,
+          );
+        }
+
+        await execa('chown', ['-R', 'portlama:portlama', serverDest]);
+        subtask.output = 'Panel server updated';
+      },
+      rendererOptions: { persistentOutput: true },
+    },
+    {
+      title: 'Updating panel-client',
+      task: async (_ctx, subtask) => {
+        const clientSrc = join(vendorDir, 'panel-client');
+        const clientDest = join(installDir, 'panel-client');
+
+        if (!existsSync(clientSrc)) {
+          throw new Error(
+            `Panel client source not found at ${clientSrc}. Ensure the package is intact.`,
+          );
+        }
+
+        const prebuiltDist = join(clientSrc, 'dist');
+        if (!existsSync(join(prebuiltDist, 'index.html'))) {
+          throw new Error(
+            'Pre-built panel-client dist not found. The package may be corrupted.',
+          );
+        }
+
+        subtask.output = 'Copying panel-client dist...';
+        const distDest = join(clientDest, 'dist');
+        await rm(distDest, { recursive: true, force: true });
+        await cp(prebuiltDist, distDest, { recursive: true });
+
+        await execa('chown', ['-R', 'portlama:portlama', clientDest]);
+        subtask.output = 'Panel client updated';
+      },
+      rendererOptions: { persistentOutput: true },
+    },
+    {
+      title: 'Updating panel configuration',
+      task: async (_ctx, subtask) => {
+        const configPath = join(configDir, 'panel.json');
+
+        if (!existsSync(configPath)) {
+          subtask.output = 'No existing config — skipping (full install needed)';
+          return;
+        }
+
+        subtask.output = 'Merging configuration...';
+        const existing = JSON.parse(await readFile(configPath, 'utf8'));
+
+        const config = {
+          ...existing,
+          ip: ctx.ip,
+          dataDir: configDir,
+          staticDir: join(installDir, 'panel-client', 'dist'),
+        };
+
+        await writeFile(
+          configPath,
+          JSON.stringify(config, null, 2) + '\n',
+          { mode: 0o640 },
+        );
+        await execa('chown', ['portlama:portlama', configPath]);
+
+        subtask.output = 'Configuration updated';
+      },
+      rendererOptions: { persistentOutput: true },
+    },
+    {
+      title: 'Reloading systemd and restarting panel',
+      task: async (_ctx, subtask) => {
+        subtask.output = 'Reloading systemd daemon...';
+        await execa('systemctl', ['daemon-reload']);
+
+        subtask.output = 'Starting portlama-panel...';
+        await execa('systemctl', ['start', 'portlama-panel']);
+
+        subtask.output = 'Waiting for service to start...';
+        await sleep(3000);
+
+        const { stdout: status } = await execa('systemctl', [
+          'is-active',
+          'portlama-panel',
+        ]);
+        if (status.trim() !== 'active') {
+          const { stdout: logs } = await execa('journalctl', [
+            '-u',
+            'portlama-panel',
+            '--no-pager',
+            '-n',
+            '20',
+          ]);
+          throw new Error(
+            `Panel service failed to start. Status: ${status.trim()}\nRecent logs:\n${logs}`,
+          );
+        }
+
+        subtask.output = 'Running health check...';
+        try {
+          const { stdout: healthResponse } = await execa('curl', [
+            '-s',
+            '--max-time',
+            '5',
+            'http://127.0.0.1:3100/api/health',
+          ]);
+          subtask.output = `Panel running. Health: ${healthResponse}`;
+        } catch (error) {
+          const { stdout: logs } = await execa('journalctl', [
+            '-u',
+            'portlama-panel',
+            '--no-pager',
+            '-n',
+            '20',
+          ]);
+          throw new Error(
+            `Panel health check failed.\nRecent logs:\n${logs}\n${error.message}`,
+          );
+        }
+      },
+      rendererOptions: { persistentOutput: true },
+    },
+  ]);
+}