@lamalibre/create-portlama 1.0.49 → 1.0.52

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamalibre/create-portlama",
-  "version": "1.0.49",
+  "version": "1.0.52",
   "description": "One-command setup for secure reverse tunnels with a management dashboard",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/lib/service-config.js

@@ -168,6 +168,8 @@ portlama ALL=(root) NOPASSWD: /usr/bin/test -f /etc/nginx/sites-available/*
 portlama ALL=(root) NOPASSWD: /usr/bin/test -r /etc/portlama/pki/*
 
 # --- self-update: run update script in its own cgroup (survives panel restart) ---
-portlama ALL=(root) NOPASSWD: /usr/bin/systemd-run --unit portlama-update-* --no-block /usr/bin/bash /etc/portlama/portlama-update-*
+# Each argument is pinned except the script ID suffix (16-char hex from randomBytes).
+# The sudoers wildcard only matches within a single argument — no trailing args accepted.
+portlama ALL=(root) NOPASSWD: /usr/bin/systemd-run --unit portlama-update-* --no-block /usr/bin/bash /etc/portlama/portlama-update-*.sh
 `;
 }

package/src/tasks/redeploy.js

@@ -1,5 +1,5 @@
 import { execa } from 'execa';
-import { writeFile, readFile, cp, rm } from 'node:fs/promises';
+import { writeFile, readFile, cp, rm, rename, open } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { setTimeout as sleep } from 'node:timers/promises';
 import { fileURLToPath } from 'node:url';
@@ -183,7 +183,12 @@ export function redeployTasks(ctx, task) {
           staticDir: join(installDir, 'panel-client', 'dist'),
         };
 
-        await writeFile(configPath, JSON.stringify(config, null, 2) + '\n', { mode: 0o640 });
+        const tmpConfigPath = `${configPath}.tmp`;
+        await writeFile(tmpConfigPath, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
+        const fd = await open(tmpConfigPath, 'r');
+        await fd.sync();
+        await fd.close();
+        await rename(tmpConfigPath, configPath);
         await execa('chown', ['portlama:portlama', configPath]);
 
         subtask.output = 'Configuration updated';