@lamalibre/create-portlama 1.0.31 → 1.0.33

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamalibre/create-portlama",
-  "version": "1.0.31",
+  "version": "1.0.33",
   "description": "One-command setup for secure reverse tunnels with a management dashboard",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/lib/service-config.js

@@ -74,7 +74,8 @@ portlama ALL=(root) NOPASSWD: /usr/bin/systemctl restart portlama-panel
 # --- nginx config test ---
 portlama ALL=(root) NOPASSWD: /usr/sbin/nginx -t
 
-# --- certbot: restrict certonly to --nginx only (prevents --manual-auth-hook) ---
+# --- certbot: restrict certonly to --nginx (code always passes --non-interactive) ---
+# Note: trailing wildcard allows additional flags; trust boundary is @lamalibre/ scope
 portlama ALL=(root) NOPASSWD: /usr/bin/certbot certonly --nginx *
 portlama ALL=(root) NOPASSWD: /usr/bin/certbot renew
 portlama ALL=(root) NOPASSWD: /usr/bin/certbot renew --cert-name *
@@ -86,7 +87,7 @@ portlama ALL=(root) NOPASSWD: /usr/bin/openssl x509 -in /etc/letsencrypt/live/*
 portlama ALL=(root) NOPASSWD: /usr/bin/openssl x509 -req -in /etc/portlama/pki/* *
 portlama ALL=(root) NOPASSWD: /usr/bin/openssl genrsa -out /etc/portlama/pki/* *
 portlama ALL=(root) NOPASSWD: /usr/bin/openssl req -new -key /etc/portlama/pki/* *
-portlama ALL=(root) NOPASSWD: /usr/bin/openssl pkcs12 -export *
+portlama ALL=(root) NOPASSWD: /usr/bin/openssl pkcs12 -export -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES -macalg sha1 -out /etc/portlama/pki/*
 
 # --- mv: restrict source to /tmp/ or known config paths ---
 portlama ALL=(root) NOPASSWD: /usr/bin/mv /tmp/* /var/www/portlama/*
@@ -111,7 +112,7 @@ portlama ALL=(root) NOPASSWD: /usr/bin/mkdir -p /etc/authelia/*
 portlama ALL=(root) NOPASSWD: /usr/bin/mkdir -p /var/log/authelia
 portlama ALL=(root) NOPASSWD: /usr/bin/mkdir -p /var/log/authelia/*
 portlama ALL=(root) NOPASSWD: /usr/bin/cat /etc/authelia/*
-portlama ALL=(root) NOPASSWD: /usr/local/bin/authelia storage *
+portlama ALL=(root) NOPASSWD: /usr/local/bin/authelia storage user totp generate *
 
 # --- Static site file operations under /var/www/portlama/ ---
 portlama ALL=(root) NOPASSWD: /usr/bin/mkdir -p /var/www/portlama/*

package/src/tasks/panel.js

@@ -83,7 +83,7 @@ export function panelTasks(ctx, task) {
 
         subtask.output = 'Installing production dependencies...';
         try {
-          await execa('npm', ['install', '--production'], {
+          await execa('npm', ['install', '--production', '--ignore-scripts'], {
             cwd: serverDest,
           });
         } catch (err) {
@@ -94,6 +94,14 @@ export function panelTasks(ctx, task) {
 
         await execa('chown', ['-R', 'portlama:portlama', serverDest]);
 
+        // Create CLI symlink for portlama-reset-admin
+        const resetAdminSrc = join(serverDest, 'src', 'cli', 'reset-admin.js');
+        const resetAdminDest = '/usr/local/bin/portlama-reset-admin';
+        if (existsSync(resetAdminSrc)) {
+          await execa('chmod', ['+x', resetAdminSrc]);
+          await execa('ln', ['-sf', resetAdminSrc, resetAdminDest]);
+        }
+
         subtask.output = 'Panel server deployed';
       },
       rendererOptions: { persistentOutput: true },

package/src/tasks/redeploy.js

@@ -103,7 +103,7 @@ export function redeployTasks(ctx, task) {
 
         subtask.output = 'Installing production dependencies...';
         try {
-          await execa('npm', ['install', '--production'], {
+          await execa('npm', ['install', '--production', '--ignore-scripts'], {
             cwd: serverDest,
           });
         } catch (err) {
@@ -113,6 +113,15 @@ export function redeployTasks(ctx, task) {
         }
 
         await execa('chown', ['-R', 'portlama:portlama', serverDest]);
+
+        // Ensure CLI symlink for portlama-reset-admin
+        const resetAdminSrc = join(serverDest, 'src', 'cli', 'reset-admin.js');
+        const resetAdminDest = '/usr/local/bin/portlama-reset-admin';
+        if (existsSync(resetAdminSrc)) {
+          await execa('chmod', ['+x', resetAdminSrc]);
+          await execa('ln', ['-sf', resetAdminSrc, resetAdminDest]);
+        }
+
         subtask.output = 'Panel server updated';
       },
       rendererOptions: { persistentOutput: true },