@lasting-beauty/chat-hub 0.1.0-beta.1

package/cli/deploy.mjs

@@ -0,0 +1,569 @@
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  statSync,
+  unlinkSync,
+  writeFileSync,
+} from 'node:fs';
+import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { ipHttpsCaddySite } from './ip-certificate.mjs';
+
+export const supportedDeploymentDistributions = Object.freeze([
+  'Ubuntu 24.04 LTS',
+  'Alibaba Cloud Linux 4',
+]);
+
+export const verifiedPlatformCliVersionPatterns = Object.freeze({
+  'lark-cli': /^(?:lark-cli version )?1\.0\.92(?:\s|$)/,
+  dws: /^(?:dws version )?v?1\.0\.(?:60|61)(?:\s|$)/,
+});
+
+export const alinuxCaddyRelease = Object.freeze({
+  version: '2.11.4',
+  archiveUrl:
+    'https://github.com/caddyserver/caddy/releases/download/v2.11.4/caddy_2.11.4_linux_amd64.tar.gz',
+  archiveSha256: '527fbf917c39189a1e3b31d34fa955601680b2d5c8055d2a87b8b9588dec7bb9',
+  binaryPath: '/usr/local/bin/caddy',
+  servicePath: '/etc/systemd/system/caddy.service',
+});
+
+export const deploymentPaths = Object.freeze({
+  data: '/var/lib/chat-hub',
+  configuration: '/etc/chat-hub',
+  credentials: '/etc/chat-hub/credentials',
+  backups: '/var/backups/chat-hub',
+  runtime: '/run/chat-hub',
+  runtimeConfig: '/etc/chat-hub/runtime.json',
+  manifest: '/etc/chat-hub/install.json',
+  service: '/etc/systemd/system/chat-hub.service',
+  caddyfile: '/etc/caddy/Caddyfile',
+  caddySnippet: '/etc/caddy/chat-hub.caddy',
+  masterKey: '/etc/chat-hub/credentials/chat-hub-master-key',
+  adminBootstrap: '/etc/chat-hub/credentials/chat-hub-admin-bootstrap',
+});
+
+const caddyImport = 'import /etc/caddy/chat-hub.caddy';
+
+export function createDeploymentPlan(
+  publicHost,
+  installDependencies,
+  platform,
+  architecture,
+  deploymentHost,
+  publicScheme = 'https',
+  certificateMode = publicScheme === 'https' ? 'managed-domain' : 'none',
+) {
+  const supported = deploymentHost?.supported ?? (platform === 'linux' && architecture === 'x64');
+  const secure = publicScheme === 'https';
+  return {
+    mode: 'plan',
+    applied: false,
+    domain: publicHost,
+    publicHost,
+    publicScheme,
+    certificateMode,
+    publicUrl: `${publicScheme}://${publicHost}`,
+    target: {
+      platform: 'linux',
+      architecture: 'x64',
+      distributions: supportedDeploymentDistributions,
+    },
+    detectedHost: deploymentHost,
+    currentPlatformSupported: supported,
+    requiresRootToApply: true,
+    installDependencies,
+    ports: {
+      public: secure ? [80, 443] : [80],
+      gateway: '127.0.0.1:8080',
+      application: '127.0.0.1:4310',
+    },
+    paths: deploymentPaths,
+    changes: [
+      '创建专用 chat-hub 系统用户和受限目录',
+      '创建 root 管理的 32 字节主密钥并通过 systemd credential 注入',
+      `生成仅显示一次、10 分钟有效的管理员 ${publicScheme.toUpperCase()} 初始化链接`,
+      '安装并启用 Chat Hub systemd 服务，应用与安全网关只监听回环地址',
+      secure
+        ? certificateMode === 'ip-shortlived'
+          ? `使用 Certbot shortlived 配置 ${publicHost} 的 IP HTTPS、自动续期并反向代理到安全网关`
+          : `配置 Caddy 为 ${publicHost} 申请 HTTPS 并反向代理到安全网关`
+        : `配置 Caddy 通过 http://${publicHost} 反向代理到安全网关（不启用 TLS）`,
+      ...(installDependencies
+        ? [
+            '允许在 Ubuntu 通过 apt、在 Alibaba Cloud Linux 4 通过校验过的官方静态资产安装缺失的 Caddy；包内飞书/钉钉 CLI 仍做固定版本校验',
+          ]
+        : ['只检查 Caddy 和包内固定版本平台 CLI，不自动安装系统依赖']),
+    ],
+    warnings: secure
+      ? certificateMode === 'ip-shortlived'
+        ? [
+            'IP 证书约 160 小时有效，续期 timer 和成功后 Caddy reload 必须持续正常',
+            '公网 IP 变化会使入口失效；正式实例应绑定稳定 EIP',
+          ]
+        : []
+      : [
+          'HTTP 不加密管理员密码、会话、平台数据和模型配置，只适合临时受控测试',
+          '阿里云安全组必须把 TCP 80 来源限制为管理员固定公网 IP，不能开放 0.0.0.0/0',
+          '迁移到域名 HTTPS 前，不应处理真实工作数据或配置真实平台与模型凭证',
+        ],
+    blockers: ['公司许可证与公开 npm 发布许可尚未完成；不影响本地 tarball 内部部署'],
+  };
+}
+
+export function detectDeploymentHost({
+  platform = process.platform,
+  architecture = process.arch,
+  readOsRelease = () => readFileSync('/etc/os-release', 'utf8'),
+} = {}) {
+  if (platform !== 'linux' || architecture !== 'x64') {
+    return {
+      platform,
+      architecture,
+      supported: false,
+      distribution: 'unsupported',
+      label: `${platform}-${architecture}`,
+    };
+  }
+  let values;
+  try {
+    values = parseOsRelease(readOsRelease());
+  } catch (error) {
+    return {
+      platform,
+      architecture,
+      supported: false,
+      distribution: 'unknown',
+      label: '未知 Linux 发行版',
+      error: error instanceof Error ? error.message : String(error),
+    };
+  }
+  const common = {
+    platform,
+    architecture,
+    id: values.ID,
+    versionId: values.VERSION_ID,
+    prettyName: values.PRETTY_NAME,
+  };
+  if (values.ID === 'ubuntu' && values.VERSION_ID === '24.04') {
+    return {
+      ...common,
+      supported: true,
+      distribution: 'ubuntu-24.04',
+      label: values.PRETTY_NAME || 'Ubuntu 24.04 LTS',
+      caddyInstaller: 'apt',
+    };
+  }
+  if (values.ID === 'alinux' && /^4(?:\.|$)/.test(values.VERSION_ID ?? '')) {
+    return {
+      ...common,
+      supported: true,
+      distribution: 'alinux-4',
+      label: values.PRETTY_NAME || 'Alibaba Cloud Linux 4',
+      caddyInstaller: 'verified-static',
+    };
+  }
+  return {
+    ...common,
+    supported: false,
+    distribution: 'unsupported',
+    label: values.PRETTY_NAME || `${values.ID ?? 'linux'} ${values.VERSION_ID ?? ''}`.trim(),
+  };
+}
+
+export function assertSupportedDeploymentHost({
+  commandName = 'deploy --apply',
+  getUid = () => (typeof process.getuid === 'function' ? process.getuid() : undefined),
+  ...detectionOptions
+} = {}) {
+  const host = detectDeploymentHost(detectionOptions);
+  if (!host.supported) {
+    throw new Error(
+      `${commandName} 只支持 Ubuntu 24.04 x64 或 Alibaba Cloud Linux 4 x64；当前为 ${host.label}`,
+    );
+  }
+  if (getUid() !== 0) throw new Error(`${commandName} 需要通过 sudo 或 root 执行`);
+  return host;
+}
+
+export function parseOsRelease(content) {
+  if (typeof content !== 'string') throw new Error('/etc/os-release 内容无效');
+  return Object.fromEntries(
+    content
+      .split(/\r?\n/)
+      .filter((line) => line && !line.startsWith('#') && line.includes('='))
+      .map((line) => {
+        const separator = line.indexOf('=');
+        return [line.slice(0, separator), line.slice(separator + 1).replace(/^"|"$/g, '')];
+      }),
+  );
+}
+
+export function alinuxCaddySystemdUnit() {
+  return `[Unit]
+Description=Caddy
+Documentation=https://caddyserver.com/docs/
+After=network.target network-online.target
+Requires=network-online.target
+
+[Service]
+Type=notify
+User=caddy
+Group=caddy
+Environment=HOME=/var/lib/caddy
+Environment=XDG_DATA_HOME=/var/lib/caddy/.local/share
+Environment=XDG_CONFIG_HOME=/var/lib/caddy/.config
+ExecStart=${alinuxCaddyRelease.binaryPath} run --environ --config /etc/caddy/Caddyfile --adapter caddyfile
+ExecReload=${alinuxCaddyRelease.binaryPath} reload --config /etc/caddy/Caddyfile --adapter caddyfile --force
+TimeoutStopSec=5s
+LimitNOFILE=1048576
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=full
+ProtectHome=true
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+ReadWritePaths=/var/lib/caddy
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+
+export function stageDeployment({
+  domain,
+  publicHost = domain,
+  publicScheme = 'https',
+  certificateMode = publicScheme === 'https' ? 'managed-domain' : 'none',
+  packageRoot,
+  nodePath,
+  rootDirectory = '/',
+  now = Date.now(),
+  bootstrapToken = randomBytes(32).toString('base64url'),
+  larkCliPath = '/usr/local/bin/lark-cli',
+  dingtalkCliPath = '/usr/local/bin/dws',
+  preserveAdministratorCredential = false,
+}) {
+  assertSafeDeploymentInput(
+    publicHost,
+    packageRoot,
+    nodePath,
+    rootDirectory,
+    bootstrapToken,
+    larkCliPath,
+    dingtalkCliPath,
+  );
+  const expiresAt = now + 10 * 60_000;
+  const outputPath = (absolutePath) => rootedPath(rootDirectory, absolutePath);
+  for (const directory of [
+    deploymentPaths.data,
+    deploymentPaths.configuration,
+    deploymentPaths.credentials,
+    deploymentPaths.backups,
+    dirname(deploymentPaths.service),
+    dirname(deploymentPaths.caddyfile),
+  ]) {
+    mkdirSync(outputPath(directory), {
+      recursive: true,
+      mode: directory.includes('credentials') ? 0o700 : 0o755,
+    });
+  }
+  chmodSync(outputPath(deploymentPaths.configuration), 0o700);
+  chmodSync(outputPath(deploymentPaths.credentials), 0o700);
+  chmodSync(outputPath(deploymentPaths.data), 0o700);
+  chmodSync(outputPath(deploymentPaths.backups), 0o700);
+
+  const masterKeyPath = outputPath(deploymentPaths.masterKey);
+  if (existsSync(masterKeyPath)) {
+    const metadata = statSync(masterKeyPath);
+    if (!metadata.isFile() || readFileSync(masterKeyPath).length !== 32) {
+      throw new Error('现有 Chat Hub 主密钥不是 32 字节普通文件，已停止部署');
+    }
+  } else {
+    writeFileSync(masterKeyPath, randomBytes(32), { flag: 'wx', mode: 0o600 });
+  }
+  chmodSync(masterKeyPath, 0o600);
+  const administratorCredentialPath = outputPath(deploymentPaths.adminBootstrap);
+  if (preserveAdministratorCredential) {
+    if (
+      !existsSync(administratorCredentialPath) ||
+      !statSync(administratorCredentialPath).isFile()
+    ) {
+      throw new Error('升级要求保留现有管理员凭证，但凭证文件不存在');
+    }
+  } else {
+    writePrivateJson(administratorCredentialPath, {
+      token: bootstrapToken,
+      expiresAt,
+      reset: false,
+    });
+  }
+
+  if (!['http', 'https'].includes(publicScheme)) throw new Error('公网协议必须是 http 或 https');
+  const runtimeConfig = buildRuntimeConfig(
+    publicHost,
+    publicScheme,
+    packageRoot,
+    larkCliPath,
+    dingtalkCliPath,
+  );
+  const artifacts = new Map([
+    [deploymentPaths.runtimeConfig, `${JSON.stringify(runtimeConfig, null, 2)}\n`],
+    [deploymentPaths.service, systemdUnit(nodePath, packageRoot)],
+    [deploymentPaths.caddySnippet, caddySite(publicHost, publicScheme, certificateMode)],
+    [
+      deploymentPaths.manifest,
+      `${JSON.stringify(
+        {
+          version: 2,
+          domain: publicHost,
+          publicHost,
+          publicScheme,
+          certificateMode,
+          packageRoot,
+          installedAt: new Date(now).toISOString(),
+          paths: deploymentPaths,
+        },
+        null,
+        2,
+      )}\n`,
+    ],
+  ]);
+  const caddyPath = outputPath(deploymentPaths.caddyfile);
+  const existingCaddyfile = existsSync(caddyPath) ? readFileSync(caddyPath, 'utf8') : '';
+  if (!existingCaddyfile.split(/\r?\n/).some((line) => line.trim() === caddyImport)) {
+    const separator = existingCaddyfile && !existingCaddyfile.endsWith('\n') ? '\n' : '';
+    artifacts.set(deploymentPaths.caddyfile, `${existingCaddyfile}${separator}${caddyImport}\n`);
+  }
+
+  const previous = new Map();
+  try {
+    for (const [absolutePath, content] of artifacts) {
+      const target = outputPath(absolutePath);
+      previous.set(
+        absolutePath,
+        existsSync(target)
+          ? { existed: true, content: readFileSync(target), mode: statSync(target).mode & 0o777 }
+          : { existed: false },
+      );
+      writeAtomic(target, content, absolutePath === deploymentPaths.runtimeConfig ? 0o600 : 0o644);
+    }
+  } catch (error) {
+    restoreFiles(previous, outputPath);
+    throw error;
+  }
+
+  return {
+    domain: publicHost,
+    publicHost,
+    publicScheme,
+    expiresAt,
+    initializationUrl: preserveAdministratorCredential
+      ? undefined
+      : `${publicScheme}://${publicHost}/?token=${encodeURIComponent(bootstrapToken)}`,
+    paths: deploymentPaths,
+    outputPaths: Object.fromEntries(
+      Object.entries(deploymentPaths).map(([name, absolutePath]) => [
+        name,
+        outputPath(absolutePath),
+      ]),
+    ),
+    rollback: () => restoreFiles(previous, outputPath),
+  };
+}
+
+export function stageAdministratorReset({
+  domain,
+  publicHost = domain,
+  publicScheme = 'https',
+  rootDirectory = '/',
+  now = Date.now(),
+  bootstrapToken = randomBytes(32).toString('base64url'),
+}) {
+  if (typeof publicHost !== 'string' || !publicHost || /[\r\n\0]/.test(publicHost)) {
+    throw new Error('管理员重置域名无效');
+  }
+  if (!['http', 'https'].includes(publicScheme)) throw new Error('管理员重置协议无效');
+  if (!isAbsolute(rootDirectory)) throw new Error('部署根目录必须是绝对路径');
+  if (typeof bootstrapToken !== 'string' || bootstrapToken.length < 32) {
+    throw new Error('管理员重置令牌强度不足');
+  }
+  const expiresAt = now + 10 * 60_000;
+  const target = rootedPath(rootDirectory, deploymentPaths.adminBootstrap);
+  if (!existsSync(dirname(target))) throw new Error('Chat Hub 尚未部署，找不到凭证目录');
+  writePrivateJson(target, { token: bootstrapToken, expiresAt, reset: true });
+  return {
+    initializationUrl: `${publicScheme}://${publicHost}/?token=${encodeURIComponent(bootstrapToken)}`,
+    expiresAt,
+    credentialPath: target,
+  };
+}
+
+function buildRuntimeConfig(publicHost, publicScheme, packageRoot, larkCliPath, dingtalkCliPath) {
+  return {
+    id: createHash('sha256')
+      .update(`${deploymentPaths.data}:${publicScheme}:${publicHost}`)
+      .digest('hex')
+      .slice(0, 16),
+    runId: randomUUID(),
+    mode: 'live',
+    entryMode: 'public',
+    publicDomain: publicHost,
+    publicHost,
+    publicScheme,
+    packageRoot,
+    runtimeDirectory: deploymentPaths.runtime,
+    dataDirectory: deploymentPaths.data,
+    apiPort: 4310,
+    httpPort: 8080,
+    frontendPort: 4310,
+    phoneProtocol: publicScheme,
+    environment: {
+      CHAT_HUB_HOST: '127.0.0.1',
+      CHAT_HUB_PORT: '4310',
+      CHAT_HUB_DATA_DIR: deploymentPaths.data,
+      CHAT_HUB_STATIC_DIR: join(packageRoot, 'dist'),
+      CHAT_HUB_ACCOUNT_KEY: 'server-admin',
+      CHAT_HUB_AUTH_MODE: 'admin',
+      CHAT_HUB_PUBLIC_SCHEME: publicScheme,
+      LARK_CLI_PATH: larkCliPath,
+      DINGTALK_CLI_PATH: dingtalkCliPath,
+    },
+  };
+}
+
+function systemdUnit(nodePath, packageRoot) {
+  return `[Unit]
+Description=Chat Hub personal work information service
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=chat-hub
+Group=chat-hub
+WorkingDirectory=${deploymentPaths.data}
+RuntimeDirectory=chat-hub
+RuntimeDirectoryMode=0700
+UMask=0077
+Environment=HOME=${deploymentPaths.data}
+Environment=XDG_CONFIG_HOME=${deploymentPaths.data}/.config
+Environment=XDG_DATA_HOME=${deploymentPaths.data}/.local/share
+LoadCredential=chat-hub-master-key:${deploymentPaths.masterKey}
+LoadCredential=chat-hub-admin-bootstrap:${deploymentPaths.adminBootstrap}
+ExecStart=${systemdQuote(nodePath)} ${systemdQuote(join(packageRoot, 'cli', 'runtime.mjs'))} ${systemdQuote(deploymentPaths.runtimeConfig)}
+Restart=on-failure
+RestartSec=5s
+TimeoutStopSec=30s
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+ReadWritePaths=${deploymentPaths.data} ${deploymentPaths.backups}
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+
+function caddySite(publicHost, publicScheme, certificateMode) {
+  if (certificateMode === 'ip-shortlived') return ipHttpsCaddySite(publicHost);
+  const siteAddress = publicScheme === 'http' ? `http://${publicHost}` : publicHost;
+  return `${siteAddress} {
+  encode zstd gzip
+  reverse_proxy 127.0.0.1:8080 {
+    header_up Host {host}
+    header_up X-Forwarded-Proto ${publicScheme}
+    header_up X-Forwarded-For {remote_host}
+  }
+  header {
+    -Server
+    X-Content-Type-Options nosniff
+    Referrer-Policy no-referrer
+    X-Frame-Options DENY
+  }
+}
+`;
+}
+
+function writePrivateJson(path, value) {
+  writeAtomic(path, `${JSON.stringify(value)}\n`, 0o600);
+}
+
+function writeAtomic(path, content, mode) {
+  const temporary = `${path}.${randomUUID()}.tmp`;
+  writeFileSync(temporary, content, { mode });
+  chmodSync(temporary, mode);
+  renameSync(temporary, path);
+}
+
+function restoreFiles(previous, outputPath) {
+  for (const [absolutePath, state] of [...previous.entries()].reverse()) {
+    const target = outputPath(absolutePath);
+    if (!state.existed) {
+      if (existsSync(target)) unlinkSync(target);
+      continue;
+    }
+    writeFileSync(target, state.content, { mode: state.mode });
+    chmodSync(target, state.mode);
+  }
+}
+
+function rootedPath(rootDirectory, absolutePath) {
+  const root = resolve(rootDirectory);
+  if (!isAbsolute(absolutePath)) throw new Error('部署目标路径必须是绝对路径');
+  if (root === resolve('/')) return absolutePath;
+  const target = resolve(root, absolutePath.replace(/^[/\\]+/, ''));
+  const pathFromRoot = relative(root, target);
+  if (pathFromRoot.startsWith('..') || isAbsolute(pathFromRoot))
+    throw new Error('部署目标越出测试根目录');
+  return target;
+}
+
+function assertSafeDeploymentInput(
+  domain,
+  packageRoot,
+  nodePath,
+  rootDirectory,
+  bootstrapToken,
+  larkCliPath,
+  dingtalkCliPath,
+) {
+  for (const [name, value] of Object.entries({
+    domain,
+    packageRoot,
+    nodePath,
+    rootDirectory,
+    larkCliPath,
+    dingtalkCliPath,
+  })) {
+    if (typeof value !== 'string' || !value || /[\r\n\0]/.test(value)) {
+      throw new Error(`${name} 包含无效字符`);
+    }
+  }
+  if (
+    !isAbsolute(packageRoot) ||
+    !isAbsolute(nodePath) ||
+    !isAbsolute(rootDirectory) ||
+    !isAbsolute(larkCliPath) ||
+    !isAbsolute(dingtalkCliPath)
+  ) {
+    throw new Error('部署路径必须是绝对路径');
+  }
+  if (typeof bootstrapToken !== 'string' || bootstrapToken.length < 32) {
+    throw new Error('管理员初始化令牌强度不足');
+  }
+}
+
+function systemdQuote(value) {
+  return `"${value.replaceAll('\\', '\\\\').replaceAll('"', '\\"')}"`;
+}