@marcusrbrown/infra 0.9.18 → 0.10.1

package/src/commands/vpn/client.ts

@@ -0,0 +1,306 @@
+import type {goke} from 'goke'
+
+import {mkdir, writeFile} from 'node:fs/promises'
+import {resolve} from 'node:path'
+
+import {z} from 'zod'
+import {addPeer, readPeers, removePeer, renderClientConfig, writePeers, type Peer} from './peers'
+
+declare const process: {
+  env: Record<string, string | undefined>
+  exitCode?: number
+}
+
+// ─── Types ────────────────────────────────────────────────────────────────────
+
+export interface Keypair {
+  privateKey: string
+  publicKey: string
+}
+
+export type KeypairGenFn = () => Promise<Keypair>
+
+export interface VpnClientAddOpts {
+  peersJsonPath: string
+  clientsDir: string
+  serverPublicKey: string
+  endpoint: string
+  keypairGen?: KeypairGenFn
+  allowedIps?: string
+  dns?: string
+}
+
+export interface VpnClientAddResult {
+  tunnelIp: string
+  confPath: string
+}
+
+// ─── WireGuard keypair generation ─────────────────────────────────────────────
+
+/**
+ * Generate a WireGuard keypair using the local `wg` binary.
+ *
+ * Assumption: `wg` is installed locally (wireguard-tools package).
+ * The private key is generated locally and written ONLY to the gitignored
+ * clients/ directory — it never leaves the local machine.
+ */
+export async function generateKeypair(): Promise<Keypair> {
+  // Step 1: generate private key
+  const genkeyProc = Bun.spawn(['wg', 'genkey'], {
+    stdout: 'pipe',
+    stderr: 'pipe',
+  })
+
+  const [privateKeyRaw, genkeyStderr, genkeyExit] = await Promise.all([
+    new Response(genkeyProc.stdout).text(),
+    new Response(genkeyProc.stderr).text(),
+    genkeyProc.exited,
+  ])
+
+  if (genkeyExit !== 0) {
+    throw new Error(`wg genkey failed (exit ${genkeyExit}): ${genkeyStderr.trim()}`)
+  }
+
+  const privateKey = privateKeyRaw.trim()
+
+  // Step 2: derive public key from private key
+  const encoder = new TextEncoder()
+  const pubkeyProc = Bun.spawn(['wg', 'pubkey'], {
+    stdin: new ReadableStream({
+      start(controller) {
+        controller.enqueue(encoder.encode(`${privateKey}\n`))
+        controller.close()
+      },
+    }),
+    stdout: 'pipe',
+    stderr: 'pipe',
+  })
+
+  const [publicKeyRaw, pubkeyStderr, pubkeyExit] = await Promise.all([
+    new Response(pubkeyProc.stdout).text(),
+    new Response(pubkeyProc.stderr).text(),
+    pubkeyProc.exited,
+  ])
+
+  if (pubkeyExit !== 0) {
+    throw new Error(`wg pubkey failed (exit ${pubkeyExit}): ${pubkeyStderr.trim()}`)
+  }
+
+  return {
+    privateKey,
+    publicKey: publicKeyRaw.trim(),
+  }
+}
+
+// ─── Write-guard ──────────────────────────────────────────────────────────────
+
+/**
+ * Validate that the resolved output path is under the expected clients directory.
+ *
+ * This is a runtime guard (not gitignore-only) that refuses to write client
+ * .conf files (which contain private keys) outside the gitignored clients/ dir.
+ *
+ * @throws {Error} if the resolved path escapes the clients directory.
+ */
+function assertPathUnderClientsDir(confPath: string, clientsDir: string): void {
+  const resolvedClientsDir = resolve(clientsDir)
+  const resolvedConfPath = resolve(confPath)
+
+  if (!resolvedConfPath.startsWith(`${resolvedClientsDir}/`) && resolvedConfPath !== resolvedClientsDir) {
+    throw new Error(
+      `Security: refusing to write client .conf outside the clients directory. ` +
+        `Resolved path "${resolvedConfPath}" is not under "${resolvedClientsDir}". ` +
+        `Client private keys must only be written to the gitignored clients/ directory.`,
+    )
+  }
+}
+
+// ─── Core operations ──────────────────────────────────────────────────────────
+
+/**
+ * Add a new VPN client peer.
+ *
+ * 1. Generates a WireGuard keypair locally (via `wg genkey` / `wg pubkey`).
+ * 2. Assigns the next available tunnel IP via addPeer.
+ * 3. Appends the PUBLIC key + tunnel IP to peers.json.
+ * 4. Writes the client .conf (with PRIVATE key) to clients/<name>.conf.
+ *
+ * Security invariants:
+ * - The client PRIVATE key is written ONLY to the gitignored clients/ directory.
+ * - peers.json contains ONLY the public key — never the private key.
+ * - The output path is validated before writing (runtime guard, not gitignore-only).
+ */
+export async function vpnClientAdd(name: string, opts: VpnClientAddOpts): Promise<VpnClientAddResult> {
+  const {peersJsonPath, clientsDir, serverPublicKey, endpoint, allowedIps, dns} = opts
+  const keypairGen = opts.keypairGen ?? generateKeypair
+
+  // Validate the output path before doing any work
+  const confPath = resolve(clientsDir, `${name}.conf`)
+  assertPathUnderClientsDir(confPath, clientsDir)
+
+  // Generate keypair
+  const keypair = await keypairGen()
+
+  // Read current peers
+  const peersFile = await readPeers(peersJsonPath)
+
+  // Add peer (throws if duplicate name)
+  const {peers: updatedPeers, tunnelIp} = addPeer(peersFile.peers, {
+    name,
+    publicKey: keypair.publicKey,
+  })
+
+  // Write updated peers.json (PUBLIC key only — never private key)
+  await writePeers(peersJsonPath, {peers: updatedPeers})
+
+  // Render client .conf (contains PRIVATE key)
+  const confContent = renderClientConfig({
+    clientPrivateKey: keypair.privateKey,
+    serverPublicKey,
+    endpoint,
+    tunnelIp,
+    allowedIps,
+    dns,
+  })
+
+  // Ensure clients directory exists
+  await mkdir(clientsDir, {recursive: true})
+
+  // Write client .conf to the gitignored clients/ directory
+  await writeFile(confPath, confContent, {mode: 0o600})
+
+  return {tunnelIp, confPath}
+}
+
+/**
+ * List all VPN client peers from peers.json.
+ */
+export async function vpnClientList(peersJsonPath: string): Promise<Peer[]> {
+  const peersFile = await readPeers(peersJsonPath)
+  return peersFile.peers
+}
+
+/**
+ * Remove a VPN client peer from peers.json.
+ *
+ * Note: The client .conf file in clients/ is NOT deleted — the operator
+ * should delete it manually. The peer is removed from peers.json so the
+ * next deploy will revoke access.
+ */
+export async function vpnClientRemove(name: string, peersJsonPath: string): Promise<void> {
+  const peersFile = await readPeers(peersJsonPath)
+  const {peers: updatedPeers} = removePeer(peersFile.peers, name)
+  await writePeers(peersJsonPath, {peers: updatedPeers})
+}
+
+// ─── Default paths ────────────────────────────────────────────────────────────
+
+function resolveDefaultPeersJsonPath(): string {
+  // packages/cli/src/commands/vpn/ → repo root → apps/vpn/config/peers.json
+  return resolve(import.meta.dir, '..', '..', '..', '..', '..', 'apps', 'vpn', 'config', 'peers.json')
+}
+
+function resolveDefaultClientsDir(): string {
+  // packages/cli/src/commands/vpn/ → repo root → apps/vpn/clients/
+  return resolve(import.meta.dir, '..', '..', '..', '..', '..', 'apps', 'vpn', 'clients')
+}
+
+// ─── Command registration ─────────────────────────────────────────────────────
+
+export function registerVpnClient(cli: ReturnType<typeof goke>): void {
+  cli
+    .command(
+      'vpn client add <name>',
+      'Add a new VPN client peer. Generates a keypair, assigns a tunnel IP, and writes the client .conf to apps/vpn/clients/.',
+    )
+    .option(
+      '--split-tunnel [cidrs]',
+      z.string().describe('Comma-separated CIDRs for split-tunnel routing. Defaults to 0.0.0.0/0 (full tunnel).'),
+    )
+    .option('--dns [dns]', z.string().describe('DNS server for the client config.'))
+    .option('--server-pubkey [key]', z.string().describe('Server public key. Falls back to VPN_SERVER_PUBKEY env var.'))
+    .option(
+      '--endpoint [host]',
+      z.string().describe('VPN server endpoint (IP or hostname). Falls back to VPN_HOST env var.'),
+    )
+    .example('# Add a new client named "laptop"')
+    .example('infra vpn client add laptop')
+    .example('# Add a split-tunnel client')
+    .example('infra vpn client add laptop --split-tunnel 10.0.0.0/8,192.168.0.0/16')
+    .action(async (name, options) => {
+      const serverPublicKey = options.serverPubkey ?? process.env.VPN_SERVER_PUBKEY
+      const endpoint = options.endpoint ?? process.env.VPN_HOST
+
+      if (!serverPublicKey) {
+        console.error('Server public key is required. Pass --server-pubkey or set VPN_SERVER_PUBKEY.')
+        process.exitCode = 1
+        return
+      }
+
+      if (!endpoint) {
+        console.error('VPN endpoint is required. Pass --endpoint or set VPN_HOST.')
+        process.exitCode = 1
+        return
+      }
+
+      try {
+        const result = await vpnClientAdd(name as string, {
+          peersJsonPath: resolveDefaultPeersJsonPath(),
+          clientsDir: resolveDefaultClientsDir(),
+          serverPublicKey,
+          endpoint,
+          allowedIps: options.splitTunnel ?? undefined,
+          dns: options.dns ?? undefined,
+        })
+
+        console.log(`Client "${name as string}" added.`)
+        console.log(`  Tunnel IP: ${result.tunnelIp}`)
+        console.log(`  Config:    ${result.confPath}`)
+        console.log('')
+        console.log('Next step: run `infra vpn deploy` to apply the new peer to the VPN box.')
+      } catch (error) {
+        console.error(error instanceof Error ? error.message : String(error))
+        process.exitCode = 1
+      }
+    })
+
+  cli.command('vpn client list', 'List all VPN client peers from peers.json.').action(async () => {
+    try {
+      const peers = await vpnClientList(resolveDefaultPeersJsonPath())
+
+      if (peers.length === 0) {
+        console.log('No peers configured.')
+        return
+      }
+
+      console.log('Name             Tunnel IP       Public Key')
+      console.log('─────────────────────────────────────────────────────────')
+      for (const peer of peers) {
+        const name = peer.name.padEnd(16)
+        const ip = peer.tunnelIp.padEnd(15)
+        console.log(`${name} ${ip} ${peer.publicKey}`)
+      }
+    } catch (error) {
+      console.error(error instanceof Error ? error.message : String(error))
+      process.exitCode = 1
+    }
+  })
+
+  cli
+    .command(
+      'vpn client remove <name>',
+      'Remove a VPN client peer from peers.json. Run `infra vpn deploy` to revoke access.',
+    )
+    .example('# Remove a client named "laptop"')
+    .example('infra vpn client remove laptop')
+    .action(async name => {
+      try {
+        await vpnClientRemove(name as string, resolveDefaultPeersJsonPath())
+        console.log(`Peer "${name as string}" removed from peers.json.`)
+        console.log('Next step: run `infra vpn deploy` to revoke access on the VPN box.')
+      } catch (error) {
+        console.error(error instanceof Error ? error.message : String(error))
+        process.exitCode = 1
+      }
+    })
+}

package/src/commands/vpn/deploy.test.ts

@@ -0,0 +1,208 @@
+import {resolve} from 'node:path'
+import {afterEach, beforeEach, describe, expect, it, spyOn} from 'bun:test'
+
+import {getVpnDeployEnv, validateVpnRemotePreconditions} from './deploy'
+
+const cliDir = resolve(import.meta.dir, '../../..')
+
+const envKeys = ['HOME', 'PATH', 'SSH_AUTH_SOCK', 'VPN_HOST'] as const
+
+type ManagedEnvKey = (typeof envKeys)[number]
+
+let originalEnv: Partial<Record<ManagedEnvKey, string | undefined>>
+
+function restoreManagedEnv(): void {
+  for (const key of envKeys) {
+    const value = originalEnv[key]
+    if (value === undefined) {
+      delete process.env[key]
+      continue
+    }
+    process.env[key] = value
+  }
+}
+
+function setManagedEnv(overrides: Partial<Record<ManagedEnvKey, string | undefined>>): void {
+  restoreManagedEnv()
+  for (const [key, value] of Object.entries(overrides)) {
+    if (value === undefined) {
+      delete process.env[key]
+      continue
+    }
+    process.env[key as ManagedEnvKey] = value
+  }
+}
+
+async function runDeployCommand(
+  args: string[],
+  envOverrides: Partial<Record<ManagedEnvKey, string | undefined>> = {},
+): Promise<{stdout: string; stderr: string; exitCode: number}> {
+  const env: Record<string, string> = {}
+
+  for (const [key, value] of Object.entries(process.env)) {
+    if (value !== undefined) {
+      env[key] = value
+    }
+  }
+
+  for (const [key, value] of Object.entries(envOverrides)) {
+    if (value === undefined) {
+      delete env[key]
+    } else {
+      env[key] = value
+    }
+  }
+
+  if (!Object.prototype.hasOwnProperty.call(envOverrides, 'HOME') && !env.HOME) {
+    env.HOME = '/tmp/test-home'
+  }
+
+  if (!Object.prototype.hasOwnProperty.call(envOverrides, 'PATH') && !env.PATH) {
+    env.PATH = '/usr/bin:/bin'
+  }
+
+  if (!Object.prototype.hasOwnProperty.call(envOverrides, 'SSH_AUTH_SOCK') && !env.SSH_AUTH_SOCK) {
+    env.SSH_AUTH_SOCK = '/tmp/test-sock'
+  }
+
+  env.NO_COLOR = '1'
+
+  const proc = Bun.spawn(['bun', 'src/cli.ts', 'vpn', 'deploy', ...args], {
+    cwd: cliDir,
+    env,
+    stdout: 'pipe',
+    stderr: 'pipe',
+  })
+
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited,
+  ])
+
+  return {stdout, stderr, exitCode}
+}
+
+describe('vpn deploy', () => {
+  beforeEach(() => {
+    originalEnv = Object.fromEntries(envKeys.map(key => [key, process.env[key]]))
+  })
+
+  afterEach(() => {
+    restoreManagedEnv()
+  })
+
+  describe('getVpnDeployEnv', () => {
+    it('returns the expected deploy environment when required variables are present', () => {
+      setManagedEnv({
+        VPN_HOST: '1.2.3.4',
+        HOME: '/tmp/test-home',
+        PATH: '/usr/bin:/bin',
+        SSH_AUTH_SOCK: '/tmp/test-sock',
+      })
+
+      const env = getVpnDeployEnv()
+
+      expect(env.VPN_HOST).toBe('1.2.3.4')
+      expect(env.HOME).toBe('/tmp/test-home')
+      expect(env.PATH).toBe('/usr/bin:/bin')
+      expect(env.SSH_AUTH_SOCK).toBe('/tmp/test-sock')
+    })
+
+    it('throws when SSH_AUTH_SOCK is missing', () => {
+      setManagedEnv({
+        VPN_HOST: '1.2.3.4',
+        HOME: '/tmp/test-home',
+        PATH: '/usr/bin:/bin',
+        SSH_AUTH_SOCK: undefined,
+      })
+
+      expect(() => getVpnDeployEnv()).toThrow('SSH_AUTH_SOCK')
+    })
+
+    it('throws when PATH is missing', () => {
+      setManagedEnv({
+        VPN_HOST: '1.2.3.4',
+        HOME: '/tmp/test-home',
+        PATH: undefined,
+        SSH_AUTH_SOCK: '/tmp/test-sock',
+      })
+
+      expect(() => getVpnDeployEnv()).toThrow('PATH')
+    })
+  })
+
+  describe('validateVpnRemotePreconditions', () => {
+    it('throws when gh is not available', () => {
+      const spy = spyOn(Bun, 'which').mockReturnValue(null)
+
+      try {
+        expect(() => validateVpnRemotePreconditions()).toThrow('gh')
+      } finally {
+        spy.mockRestore()
+      }
+    })
+
+    it('does not throw when gh is available', () => {
+      const spy = spyOn(Bun, 'which').mockReturnValue('/usr/bin/gh')
+
+      try {
+        expect(() => validateVpnRemotePreconditions()).not.toThrow()
+      } finally {
+        spy.mockRestore()
+      }
+    })
+  })
+
+  describe('--remote (default) dry-run', () => {
+    it('prints planned actions without invoking gh', async () => {
+      const {stdout, exitCode} = await runDeployCommand(['--dry-run'], {
+        HOME: '/tmp/test-home',
+        PATH: process.env.PATH ?? '/usr/bin:/bin',
+        SSH_AUTH_SOCK: '/tmp/test-sock',
+      })
+
+      expect(exitCode).toBe(0)
+      expect(stdout).toContain('Dry run')
+      expect(stdout).toContain('Deploy VPN')
+    })
+  })
+
+  describe('--local --dry-run', () => {
+    it('prints planned local actions without spawning bun run', async () => {
+      const {stdout, exitCode} = await runDeployCommand(['--local', '--dry-run'], {
+        HOME: '/tmp/test-home',
+        PATH: process.env.PATH ?? '/usr/bin:/bin',
+        SSH_AUTH_SOCK: '/tmp/test-sock',
+      })
+
+      expect(exitCode).toBe(0)
+      expect(stdout).toContain('Dry run')
+      expect(stdout).toContain('local')
+    })
+
+    it('succeeds even when SSH_AUTH_SOCK is unset', async () => {
+      const {stdout, exitCode} = await runDeployCommand(['--local', '--dry-run'], {
+        HOME: '/tmp/test-home',
+        PATH: process.env.PATH ?? '/usr/bin:/bin',
+        SSH_AUTH_SOCK: undefined,
+      })
+
+      expect(exitCode).toBe(0)
+      expect(stdout).toContain('Dry run')
+    })
+  })
+
+  describe('--force-server-key --dry-run', () => {
+    it('includes --force-server-key in the planned command', async () => {
+      const {stdout, exitCode} = await runDeployCommand(['--local', '--force-server-key', '--dry-run'], {
+        HOME: '/tmp/test-home',
+        PATH: process.env.PATH ?? '/usr/bin:/bin',
+        SSH_AUTH_SOCK: '/tmp/test-sock',
+      })
+
+      expect(exitCode).toBe(0)
+      expect(stdout).toContain('--force-server-key')
+    })
+  })
+})

package/src/commands/vpn/deploy.ts

@@ -0,0 +1,143 @@
+import type {goke} from 'goke'
+
+import {z} from 'zod'
+
+declare const process: {
+  env: Record<string, string | undefined>
+  exitCode?: number
+}
+
+const REPO = 'marcusrbrown/infra'
+const WORKFLOW_NAME = 'Deploy VPN'
+const WORKFLOW_URL = 'https://github.com/marcusrbrown/infra/actions/workflows/deploy-vpn.yaml'
+
+type CliInstance = ReturnType<typeof goke>
+
+// ─── Env helpers ─────────────────────────────────────────────────────────────
+
+export function getVpnDeployEnv(): Record<string, string> {
+  const path = process.env.PATH
+  const home = process.env.HOME
+  const sshAuthSock = process.env.SSH_AUTH_SOCK
+
+  if (!path) {
+    throw new Error('PATH is required for local deploy')
+  }
+
+  if (!home) {
+    throw new Error('HOME is required for local deploy')
+  }
+
+  if (!sshAuthSock) {
+    throw new Error('SSH_AUTH_SOCK is required for local deploy. Start ssh-agent and load your deploy key first.')
+  }
+
+  return {
+    PATH: path,
+    HOME: home,
+    SSH_AUTH_SOCK: sshAuthSock,
+    VPN_HOST: process.env.VPN_HOST ?? '',
+  }
+}
+
+export function validateVpnRemotePreconditions(): void {
+  if (!Bun.which('gh')) {
+    throw new Error('gh CLI is required for remote deploy. Install gh and run `gh auth login`.')
+  }
+}
+
+// ─── Command registration ─────────────────────────────────────────────────────
+
+export function registerVpnDeploy(cli: CliInstance): void {
+  cli
+    .command(
+      'vpn deploy',
+      'Deploy the VPN. Default mode triggers the GitHub Deploy VPN workflow, while --local runs apps/vpn deploy directly with Bun.',
+    )
+    .option(
+      '--local',
+      z
+        .boolean()
+        .default(false)
+        .describe('Run local deployment with Bun using apps/vpn instead of triggering GitHub Actions.'),
+    )
+    .option(
+      '--dry-run',
+      z
+        .boolean()
+        .default(false)
+        .describe(
+          'Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.',
+        ),
+    )
+    .option(
+      '--force-server-key',
+      z
+        .boolean()
+        .default(false)
+        .describe(
+          'Force regeneration of the server WireGuard keypair. WARNING: invalidates all existing client configs.',
+        ),
+    )
+    .example('# Trigger remote GitHub Actions deploy (default mode)')
+    .example('infra vpn deploy')
+    .example('# Validate local deploy preconditions and planned command')
+    .example('infra vpn deploy --local --dry-run')
+    .example('# Run local deploy with explicit SSH agent context')
+    .example('infra vpn deploy --local')
+    .action(async options => {
+      if (options.local) {
+        const command = [
+          'bun',
+          'run',
+          '--cwd',
+          'apps/vpn',
+          'deploy',
+          ...(options.forceServerKey ? ['--force-server-key'] : []),
+        ]
+
+        if (options.dryRun) {
+          console.log('Dry run: local vpn deploy')
+          console.log(`- command: ${command.join(' ')}`)
+          return
+        }
+
+        const env = getVpnDeployEnv()
+
+        const child = Bun.spawn(command, {
+          env,
+          stdout: 'inherit',
+          stderr: 'inherit',
+        })
+
+        const exitCode = await child.exited
+        if (exitCode !== 0) {
+          throw new Error(`Local deploy failed with exit code ${exitCode}`)
+        }
+
+        return
+      }
+
+      validateVpnRemotePreconditions()
+
+      if (options.dryRun) {
+        console.log('Dry run: remote vpn deploy')
+        console.log(`- command: gh workflow run "${WORKFLOW_NAME}" --repo ${REPO}`)
+        console.log(`- workflow URL: ${WORKFLOW_URL}`)
+        return
+      }
+
+      const child = Bun.spawn(['gh', 'workflow', 'run', WORKFLOW_NAME, '--repo', REPO], {
+        stdout: 'inherit',
+        stderr: 'inherit',
+      })
+
+      const exitCode = await child.exited
+      if (exitCode !== 0) {
+        throw new Error(`Failed to trigger "${WORKFLOW_NAME}" workflow (exit code ${exitCode})`)
+      }
+
+      console.log(`Workflow triggered: ${WORKFLOW_URL}`)
+      console.log('Approve the vpn environment deployment in GitHub Actions to continue.')
+    })
+}