@marcusrbrown/infra 0.9.17 → 0.10.0

package/src/commands/vpn/status.ts

@@ -0,0 +1,78 @@
+import type {goke} from 'goke'
+import type {ActionCtx} from '../../lib/action-ctx'
+
+import {z} from 'zod'
+
+import {validateVpnHost} from './host'
+import {getVpnWgStatus, type SpawnFn} from './shared'
+
+export {getVpnStatusSummary} from './shared'
+
+declare const process: {
+  env: Record<string, string | undefined>
+  exitCode?: number
+}
+
+// ─── Action (exported for direct testing) ────────────────────────────────────
+
+export async function vpnStatusAction(
+  options: {key?: string | undefined},
+  ctx: ActionCtx,
+  spawn?: SpawnFn,
+): Promise<void> {
+  const hostEnvKey = options.key ?? 'VPN_HOST'
+  const host = process.env[hostEnvKey]
+
+  if (!host) {
+    ctx.console.error(`VPN host not set. Export ${hostEnvKey} or pass --key <env-name> pointing to a set variable.`)
+    ctx.process.exit(1)
+    return
+  }
+
+  try {
+    validateVpnHost(host)
+  } catch (error) {
+    ctx.console.error(error instanceof Error ? error.message : String(error))
+    ctx.process.exit(1)
+    return
+  }
+
+  ctx.console.log('VPN status')
+  ctx.console.log('')
+
+  const result = await getVpnWgStatus(host, spawn)
+
+  if (!result.ok && !result.wgShow) {
+    ctx.console.error(`Error: ${result.error ?? 'Unknown error'}`)
+    ctx.process.exit(1)
+    return
+  }
+
+  const wgShow = result.wgShow
+
+  if (wgShow?.serverPublicKey) {
+    ctx.console.log(`Server public key: ${wgShow.serverPublicKey}`)
+  }
+
+  ctx.console.log(`Peers: ${wgShow?.peerCount ?? 0}`)
+  ctx.console.log('')
+
+  if (result.ok && wgShow?.interfaceUp) {
+    ctx.console.log('Status: OK')
+  } else {
+    ctx.console.log('Status: DEGRADED (WireGuard interface not up)')
+    ctx.process.exit(1)
+  }
+}
+
+// ─── Command registration ─────────────────────────────────────────────────────
+
+export function registerVpnStatus(cli: ReturnType<typeof goke>): void {
+  cli
+    .command('vpn status', 'Show operational health of the VPN box via SSH and wg show.')
+    .option(
+      '--key [key]',
+      z.string().describe('Environment variable name holding the SSH host. Falls back to VPN_HOST when omitted.'),
+    )
+    .action((options, ctx) => vpnStatusAction(options, ctx))
+}

package/src/conventions.test.ts

@@ -11,7 +11,7 @@ const ALLOWED_SHELL_SCRIPTS = new Set(['apps/keeweb/deploy.sh'])
 // MCP drift-guard: sensitive tool set (two-layer security model)
 // ---------------------------------------------------------------------------
 //
-// These 6 commands are source-gated: they are NOT in MCP_ALLOWLIST and are
+// These commands are source-gated: they are NOT in MCP_ALLOWLIST and are
 // therefore never registered as MCP tools. They remain CLI-only.
 //
 // WHY each is source-gated (primary layer — MCP_ALLOWLIST exclusion):
@@ -21,6 +21,11 @@ const ALLOWED_SHELL_SCRIPTS = new Set(['apps/keeweb/deploy.sh'])
 //   gateway backup       — secret-bearing: writes CA private key material to a tarball
 //   cliproxy keys list   — secret-disclosing: prints live bearer tokens in plaintext
 //   cliproxy config get  — secret-disclosing: dumps management config incl. management key
+//   vpn deploy           — mutating: deploys WireGuard config to live VPN box
+//   vpn logs             — sensitive: streams journalctl logs that may reveal peer IPs/traffic
+//   vpn client add       — mutating: generates keypair + appends peer + triggers redeploy
+//   vpn client list      — sensitive: lists peer public keys and tunnel IPs
+//   vpn client remove    — mutating: removes peer + triggers redeploy
 //
 // Defense-in-depth (secondary layer — opencode.jsonc `permission: deny`):
 // Even if MCP_ALLOWLIST were mistakenly re-expanded, opencode's native tool
@@ -37,6 +42,12 @@ const SENSITIVE_MCP_COMMANDS: readonly string[] = [
   'gateway backup',
   'cliproxy keys list',
   'cliproxy config get',
+  // VPN: mutating / sensitive / log-streaming — CLI-only
+  'vpn deploy',
+  'vpn logs',
+  'vpn client add',
+  'vpn client list',
+  'vpn client remove',
 ]
 
 // Accepted version-comment forms on SHA-pinned `uses:` lines:

package/src/resources/known_hosts

@@ -26,3 +26,21 @@ metrics.fro.bot ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAy
 |1|8o6qExp0klmE80pMU2CYvmbGqSQ=|064FdS/NWWEIU7EjmGBCwCek+DE= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICRCMPA99bZJ1w+QdZPrTzLK06LF7t91tb0GbKfBkA72
 |1|1nwXP2iRwBq0GXyE94EXYJuaUCQ=|Wxoe6EvzjZbk02Hr4mx1YZOciUM= ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCma/Y9qRPlZ8v1wnQQBfwghQ0XbtSMn7QHVgIFGBjbO+Xqim7Lv9EArn58HIVACsZKMD0e9T90r70TDXYTWuZ6+RQ2x2soE6DcG/T/2wyan40hVtXLSCg8hx9DNjLR3RBwkiJcbdrYCqpDmi4kOuJAJ+b5JxUhJAkdF5M9xhUko59HtUm5I/j1T2Df60+7CdKMGZKMrCRios/q4lvgImuWS3aZuNQNuJiv6rfhX7L9LqezlJUgw1AbOzaqPXbZ9xpzt8yklGZQNa5I/CS6pEgn4/SKiRsetpgd4SCB9UuCR7ia/M0VU8itNPMZY11Pi+YwJKfJVZDtS+OSFkFxea8B1MyxDZkvOwnzYVx9xG6W48Oi06x4pQgJcqq5V52xM4upSlVtws5gTLNm/3KaJZ3kb7IK4HnTEUQrz/UShtyP1crsqwj5eoDnvcUfaMHx/YC/7LlQFp8AO8W/KEYWzlycJpZLqPrO/gqoiR0AG9NMP0SSRaD7M2pcQ4tKM1xyopE=
 |1|lwRlQiSSd0h7iti76fvRXTtbkSw=|D//yCCMd1iZftlbjJ0NhKCCf5/8= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOm6bQkB9dGaPJAVbk9IrVxZSM0KrkUikv8JgVrW0iJMKorJ233GaK03n2/5cuAJ/D3z6nN/pF6QGApWfm6s/JA=
+
+# wg-egress static IP (52.208.116.13)
+# 52.208.116.13:22 SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.15
+52.208.116.13 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILA4LGgnvBjq/yoOKLjzFefGzo9gAspxwfbY8aACj/3q
+# 52.208.116.13:22 SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.15
+# 52.208.116.13:22 SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.15
+52.208.116.13 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCOSk8SjUJHwOzUbb/R0XWu2h/BmtPjDsbzkGZIryUZ00OBeSb2V70BHVagC41BH7XEfMT5jxFJKIAHx4iqcdjrjUfR+lTIJVdHjDpCHLxzKBRQsE9uLPkSoz+DR2Y9mg8tkBXWc2rol+SqjnOWkGsavJey7+bZwEadFPBCwJnCSkn+iIdu6BO2e0X8wvpLC+ThhWXPu8tUiPY5rPgDXtCzj5rROCL79Vh5HcWONmoOzTAnaH6WMlLedX37xM4Vayl62MKyFIQE7Pw/zg2l5StEzIvQjornMs09unFlZnWYla3+T3vwTaqh6B4sbdM332+Rxw0FoHb99xgWqHpk5BnZe6Dc+l6ZHVY6p8j1CSa3/8JMGzr62/OlYfnIOwW3HvHG8R6jmi++LlmfeGmUDOypl9yfAVNPRazEVXq+eWC1helxoRBvkabwpAAKg3aihQDxLPfEi1q8qYORzb/ZAU8z8HqBAfDD6wIjacq1HCUKhZA3QN+E2skjD+IdsVx4FF0=
+# 52.208.116.13:22 SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.15
+52.208.116.13 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ5sx3iCboYm5TahbLThB4fWbnz391FDUFcRg+CfvXRCKHAuL8RTdkUaWK3OaFA4Xu1+37B0k3RYfbsBZ6vg6So=
+# 52.208.116.13:22 SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.15
+# 52.208.116.13:22 SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.15
+|1|j1LnSfd4ntnFE7CxqDqu6aaQWLo=|A8bf0bH74R6KoEHVjeDDemArv9A= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ5sx3iCboYm5TahbLThB4fWbnz391FDUFcRg+CfvXRCKHAuL8RTdkUaWK3OaFA4Xu1+37B0k3RYfbsBZ6vg6So=
+# 52.208.116.13:22 SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.15
+|1|4GGoI+hl2sBnBBkgwvuNYyDWsVs=|M6RYPIm/v9wCDInvvra6yLcQneY= ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCOSk8SjUJHwOzUbb/R0XWu2h/BmtPjDsbzkGZIryUZ00OBeSb2V70BHVagC41BH7XEfMT5jxFJKIAHx4iqcdjrjUfR+lTIJVdHjDpCHLxzKBRQsE9uLPkSoz+DR2Y9mg8tkBXWc2rol+SqjnOWkGsavJey7+bZwEadFPBCwJnCSkn+iIdu6BO2e0X8wvpLC+ThhWXPu8tUiPY5rPgDXtCzj5rROCL79Vh5HcWONmoOzTAnaH6WMlLedX37xM4Vayl62MKyFIQE7Pw/zg2l5StEzIvQjornMs09unFlZnWYla3+T3vwTaqh6B4sbdM332+Rxw0FoHb99xgWqHpk5BnZe6Dc+l6ZHVY6p8j1CSa3/8JMGzr62/OlYfnIOwW3HvHG8R6jmi++LlmfeGmUDOypl9yfAVNPRazEVXq+eWC1helxoRBvkabwpAAKg3aihQDxLPfEi1q8qYORzb/ZAU8z8HqBAfDD6wIjacq1HCUKhZA3QN+E2skjD+IdsVx4FF0=
+# 52.208.116.13:22 SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.15
+|1|6g8lttzHI3BCW6rIf1/Bteo1KcM=|bNbGP2QK2pUdPmhplw6eVzspe5g= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILA4LGgnvBjq/yoOKLjzFefGzo9gAspxwfbY8aACj/3q
+# 52.208.116.13:22 SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.15
+# 52.208.116.13:22 SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.15