@monster-orange/den 0.2.7 → 0.3.0

package/src/shared/edge/runtime.ts

@@ -1,47 +1,30 @@
 /**
- * Side effects for the edge: docker, mkcert, files. Thin on purpose — every
- * routing decision lives in render.ts.
+ * Side effects for the edge: docker, files, and the TLS strategy's (tls.ts).
+ * Thin on purpose — every routing decision lives in render.ts.
  */
-import { spawnSync } from "child_process";
 import * as fs from "fs";
 import * as net from "net";
 import * as path from "path";
+import { must, sh } from "./exec.js";
 import {
-  certNames,
+  EDGE_ROOT_LABEL,
   edgeNames,
   renderEdgeCompose,
   renderEdgeDynamic,
 } from "./render.js";
+import {
+  assertCaUsable,
+  caDir,
+  caTrusted,
+  edgeTrust,
+  edgeUntrust,
+  sharedCa,
+  tlsStrategyFor,
+  warnImplicitTlsOnce,
+} from "./tls.js";
 import type { EdgeConfig } from "./types.js";
 
-function sh(
-  cmd: string,
-  args: string[],
-  opts: { env?: NodeJS.ProcessEnv; inherit?: boolean } = {},
-) {
-  const r = spawnSync(cmd, args, {
-    encoding: "utf-8",
-    env: { ...process.env, ...opts.env },
-    stdio: opts.inherit ? "inherit" : "pipe",
-  });
-  if (r.error) throw new Error(`${cmd} is not installed (${r.error.message})`);
-  return {
-    code: r.status ?? 1,
-    out: (r.stdout ?? "").trim(),
-    err: (r.stderr ?? "").trim(),
-  };
-}
-
-function must(
-  cmd: string,
-  args: string[],
-  opts: { env?: NodeJS.ProcessEnv } = {},
-): string {
-  const r = sh(cmd, args, opts);
-  if (r.code !== 0)
-    throw new Error(`${cmd} ${args.join(" ")} failed:\n${r.err || r.out}`);
-  return r.out;
-}
+export { assertCaUsable, caDir, caTrusted, sharedCa };
 
 function write(file: string, content: string): void {
   fs.mkdirSync(path.dirname(file), { recursive: true });
@@ -68,102 +51,25 @@ export function portInUse(port: number): Promise<boolean> {
   });
 }
 
-// ── Certificates (org-scoped CA) ─────────────────────────────────────────────
+// ── Certificates (the edge.tls strategy, see tls.ts) ────────────────────────
 
-export function caDir(cfg: EdgeConfig): string {
-  return cfg.caroot ?? path.join(cfg.stateDir, "ca");
-}
-
-/** True when the edge uses an existing CA (`caroot`) rather than its own. */
-export function sharedCa(cfg: EdgeConfig): boolean {
-  return cfg.caroot !== null;
-}
-
-/**
- * A shared CA must already exist with its key: mkcert silently creates a new
- * CA in an empty CAROOT, and devices that trust the shared one would not
- * trust that. The org's own CA may be created on first use.
- */
-export function assertCaUsable(cfg: EdgeConfig): void {
-  if (!sharedCa(cfg)) return;
-  const dir = caDir(cfg);
-  if (!fs.existsSync(dir))
-    throw new Error(
-      `edge.caroot ${dir} does not exist. The edge never creates a CA there; ` +
-        `point caroot at the existing CA (\`mkcert -CAROOT\`).`,
-    );
-  for (const f of ["rootCA.pem", "rootCA-key.pem"])
-    if (!fs.existsSync(path.join(dir, f)))
-      throw new Error(
-        `edge.caroot ${dir} has no ${f}. Refusing to run: mkcert would mint a ` +
-          `new CA that other devices don't trust.`,
-      );
-}
-
-function mkcertEnv(cfg: EdgeConfig): NodeJS.ProcessEnv {
-  return { CAROOT: caDir(cfg) };
-}
-
-/** Issue (or re-issue when names changed) the edge cert from the org's own CA. */
+/** Make sure the edge's cert exists, as its TLS strategy does it. */
 export function ensureCerts(cfg: EdgeConfig): {
   issued: boolean;
   names: string[];
 } {
-  const names = certNames(cfg);
-  if (!cfg.issueCert) return { issued: false, names: [] };
-  assertCaUsable(cfg);
-  const dir = path.join(cfg.stateDir, "certs");
-  const stamp = path.join(dir, "names.txt");
-  const want = names.join("\n");
-  if (
-    fs.existsSync(path.join(dir, "edge.pem")) &&
-    fs.existsSync(stamp) &&
-    fs.readFileSync(stamp, "utf-8") === want
-  )
-    return { issued: false, names };
-  fs.mkdirSync(dir, { recursive: true });
-  if (!sharedCa(cfg))
-    fs.mkdirSync(caDir(cfg), { recursive: true, mode: 0o700 });
-  must(
-    "mkcert",
-    [
-      "-cert-file",
-      path.join(dir, "edge.pem"),
-      "-key-file",
-      path.join(dir, "edge-key.pem"),
-      ...names,
-    ],
-    { env: mkcertEnv(cfg) },
-  );
-  write(stamp, want);
-  return { issued: true, names };
+  const r = tlsStrategyFor(cfg).capabilities.ensure(cfg);
+  return { issued: r.issued, names: r.names };
 }
 
-/** Install the org CA into the system + browser trust stores (prompts for a password). */
+/** `edge trust`: install the CA (mkcert only; prompts for a password). */
 export function trustCa(cfg: EdgeConfig): number {
-  assertCaUsable(cfg);
-  if (!sharedCa(cfg))
-    fs.mkdirSync(caDir(cfg), { recursive: true, mode: 0o700 });
-  return sh("mkcert", ["-install"], { env: mkcertEnv(cfg), inherit: true })
-    .code;
+  return edgeTrust(cfg);
 }
 
+/** `edge untrust` (mkcert only; never a shared CA). */
 export function untrustCa(cfg: EdgeConfig): number {
-  if (sharedCa(cfg))
-    throw new Error(
-      `edge.caroot is a shared CA (${caDir(cfg)}); other tools and devices ` +
-        `rely on it being trusted, so the edge never uninstalls it.`,
-    );
-  return sh("mkcert", ["-uninstall"], { env: mkcertEnv(cfg), inherit: true })
-    .code;
-}
-
-/** Whether the org CA is in the macOS system keychain (null: can't tell). */
-export function caTrusted(cfg: EdgeConfig): boolean | null {
-  const pem = path.join(caDir(cfg), "rootCA.pem");
-  if (!fs.existsSync(pem)) return false;
-  if (process.platform !== "darwin") return null;
-  return sh("security", ["verify-cert", "-c", pem]).code === 0;
+  return edgeUntrust(cfg);
 }
 
 // ── Included dynamic config ─────────────────────────────────────────────────
@@ -188,9 +94,13 @@ export function includeFiles(dir: string | null): string[] {
  */
 const INCLUDED_LEDGER = "included.json";
 
+/** A stack's own route file (`stack-<project>.yml`, stacks/runtime.ts). */
+export const isStackRoutes = (f: string): boolean =>
+  /^stack-.*\.ya?ml$/.test(f);
+
 /** Files other writers own in the dynamic directory: never copied over or pruned. */
-const isOwnedElsewhere = (f: string): boolean =>
-  f === GENERATED || /^stack-.*\.ya?ml$/.test(f);
+export const isOwnedElsewhere = (f: string): boolean =>
+  f === GENERATED || isStackRoutes(f);
 
 function readLedger(stateDir: string): string[] {
   try {
@@ -228,7 +138,101 @@ export function syncIncluded(cfg: EdgeConfig): string[] {
 
 // ── Edge ─────────────────────────────────────────────────────────────────────
 
-export async function edgeUp(cfg: EdgeConfig) {
+/** Where the dynamic config mounts in the edge container (render.ts). */
+const DYNAMIC_TARGET = "/etc/edge/dynamic";
+
+/** An existing container of the edge's name: who owns it, as it says. */
+export interface ExistingEdge {
+  /** Its `den.edge.root` label, or null for an unlabelled (legacy) edge. */
+  root: string | null;
+  /** The dir its dynamic-config mount comes from, when it has one. */
+  mountsDir: string | null;
+}
+
+/** The container named `name`, any state; null when there is none. */
+export function existingEdge(name: string): ExistingEdge | null {
+  const r = sh("docker", [
+    "inspect",
+    "--type",
+    "container",
+    "-f",
+    `{{index .Config.Labels "${EDGE_ROOT_LABEL}"}}|{{range .Mounts}}{{.Source}}>{{.Destination}};{{end}}`,
+    name,
+  ]);
+  // A container always prints the separator; nothing at all is no answer.
+  if (r.code !== 0 || !r.out.includes("|")) return null;
+  const [label, mounts] = r.out.split("|");
+  const root = label && label !== "<no value>" ? label : null;
+  let mountsDir: string | null = null;
+  for (const m of (mounts ?? "").split(";")) {
+    const [src, dst] = m.split(">");
+    if (src && dst === DYNAMIC_TARGET) mountsDir = path.dirname(src);
+  }
+  return { root, mountsDir };
+}
+
+function realOrSelf(p: string): string {
+  try {
+    return fs.realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
+/**
+ * Whether this invocation may create, recreate or stop the edge
+ * (0.3.0-dev.40, P1: a scratch root with its own DEN_EDGE_DIR but the real
+ * edge.org recreated the user's real edge with the scratch certs and
+ * routes; the container and project are named by org). An existing edge is
+ * ours only when its `den.edge.root` label is this state dir; an
+ * unlabelled (legacy) one is adopted only from the default state dir, never
+ * under a DEN_EDGE_DIR that overrides it. `takeOver` (`edge up
+ * --take-over`) is the only override. Nothing is touched; only paths are
+ * said.
+ */
+export function assertEdgeOwnedHere(
+  cfg: EdgeConfig,
+  opts: {
+    takeOver?: boolean;
+    warn?: (line: string) => void;
+    /** What a refusal says it won't do: "replacing" (up), "stopping" (down). */
+    verb?: "replacing" | "stopping";
+  } = {},
+): void {
+  const n = edgeNames(cfg.org);
+  const found = existingEdge(n.container);
+  if (!found) return;
+  const here = realOrSelf(cfg.stateDir);
+  const ours = found.root
+    ? realOrSelf(found.root) === here
+    : !cfg.defaultStateDir; // legacy: only from the default state dir
+  if (ours) return;
+  const other = found.root ?? found.mountsDir ?? "another state dir";
+  const warn = opts.warn ?? ((l: string) => console.warn(l));
+  // A scratch root on the real org: the name is the org's, so only another
+  // org isolates it.
+  if (cfg.defaultStateDir)
+    warn(
+      `Warning: DEN_EDGE_DIR (${cfg.stateDir}) is not this config's edge dir, ` +
+        `and edge.org "${cfg.org}" names an edge that exists already. ` +
+        `Give this root a distinct edge.org.`,
+    );
+  if (opts.takeOver) {
+    warn(`Taking over edge ${n.container} from ${other} (--take-over).`);
+    return;
+  }
+  throw new Error(
+    `edge ${n.container} belongs to ${other}; not ${opts.verb ?? "replacing"} it`,
+  );
+}
+
+export async function edgeUp(
+  cfg: EdgeConfig,
+  opts: { takeOver?: boolean } = {},
+) {
+  // Before anything is written or started: an edge of this name that
+  // another state dir owns is never replaced.
+  assertEdgeOwnedHere(cfg, opts);
   const n = edgeNames(cfg.org);
   if (cfg.ports && containerState(n.container) !== "running") {
     for (const p of [cfg.ports.http, cfg.ports.https])
@@ -240,6 +244,7 @@ export async function edgeUp(cfg: EdgeConfig) {
         );
   }
   assertCaUsable(cfg);
+  warnImplicitTlsOnce(cfg);
   ensureNetwork(n.network);
   for (const net of [
     ...(cfg.dockerLabels ? [cfg.dockerLabels.network] : []),
@@ -256,12 +261,14 @@ export async function edgeUp(cfg: EdgeConfig) {
   const included = syncIncluded(cfg);
   write(path.join(cfg.stateDir, "dynamic", GENERATED), renderEdgeDynamic(cfg));
   const compose = path.join(cfg.stateDir, "compose.yml");
-  write(compose, renderEdgeCompose(cfg));
+  write(compose, renderEdgeCompose(cfg, realOrSelf(cfg.stateDir)));
   must("docker", ["compose", "-f", compose, "up", "-d", "--remove-orphans"]);
   return { certs, included };
 }
 
 export function edgeDown(cfg: EdgeConfig): void {
+  // The project is named by org too: another dir's edge is not ours to stop.
+  assertEdgeOwnedHere(cfg, { verb: "stopping" });
   const compose = path.join(cfg.stateDir, "compose.yml");
   if (fs.existsSync(compose))
     must("docker", ["compose", "-f", compose, "down"]);

package/src/shared/edge/status.ts

@@ -6,7 +6,13 @@
 import * as fs from "fs";
 import * as path from "path";
 import { certNames, edgeDomains, edgeNames, routeUrl } from "./render.js";
+import {
+  includedRouters,
+  stackRouters,
+  type IncludedRouters,
+} from "./included.js";
 import { caTrusted, containerState } from "./runtime.js";
+import { caDir } from "./tls.js";
 import type { EdgeConfig, EdgePorts } from "./types.js";
 
 export interface EdgeStatus {
@@ -23,8 +29,34 @@ export interface EdgeStatus {
   /** Names on the issued cert, or the planned ones when none is issued yet. */
   certNames: string[];
   certIssued: boolean;
-  /** Whether the CA is trusted on this machine (null: can't tell). */
+  /** Whether the CA is trusted on this machine (null: can't tell, or none). */
   caTrusted: boolean | null;
+  /**
+   * The edge.tls strategy; whether nothing chose it (implicit mkcert);
+   * where it came from (edge.tls, the legacy caroot/issue_cert keys, or
+   * neither); and the CA directory (mkcert: the one it issues from; files:
+   * `ca` when set; none: null).
+   */
+  tls: {
+    strategy: EdgeConfig["tls"]["strategy"];
+    implicit: boolean;
+    from: EdgeConfig["tlsFrom"];
+    ca: string | null;
+  };
+  /**
+   * Routers in the included dynamic files (`edge include`), each with its
+   * source file: Traefik serves them, Den doesn't generate them.
+   */
+  included: IncludedRouters["routers"];
+  /** Included files that could not be parsed (listed, never fatal). */
+  includedErrors: IncludedRouters["errors"];
+  /**
+   * Routers in the stacks' route files (`stack-*.yml`, written by `stack
+   * up` into the edge's dynamic directory), each with its file (0.3.0-dev.32).
+   */
+  stacks: IncludedRouters["routers"];
+  /** Stack route files that could not be parsed (listed, never fatal). */
+  stackErrors: IncludedRouters["errors"];
 }
 
 export interface EdgeStatusDeps {
@@ -32,6 +64,10 @@ export interface EdgeStatusDeps {
   caTrusted: (cfg: EdgeConfig) => boolean | null;
   /** Names on the issued cert (its stamp file), or null when none is issued. */
   issuedNames: (cfg: EdgeConfig) => string[] | null;
+  /** The included files' routers (read from disk by default). */
+  included?: (cfg: EdgeConfig) => IncludedRouters;
+  /** The stacks' route files' routers (read from disk by default). */
+  stacks?: (cfg: EdgeConfig) => IncludedRouters;
 }
 
 /** The names stamp `ensureCerts` writes beside the cert. */
@@ -45,8 +81,19 @@ const defaultDeps: EdgeStatusDeps = {
   containerState,
   caTrusted,
   issuedNames: issuedCertNames,
+  included: includedRouters,
+  stacks: stackRouters,
 };
 
+/** Den's own routes: `<name>.<domain>` → upstream (no Docker asked). */
+export function edgeRoutes(cfg: EdgeConfig): EdgeStatus["routes"] {
+  return Object.entries(cfg.routes).map(([name, upstream]) => ({
+    name,
+    url: routeUrl(name, cfg),
+    upstream,
+  }));
+}
+
 export function edgeStatus(
   cfg: EdgeConfig,
   deps: EdgeStatusDeps = defaultDeps,
@@ -54,6 +101,8 @@ export function edgeStatus(
   const n = edgeNames(cfg.org);
   const state = deps.containerState(n.container);
   const issued = deps.issuedNames(cfg);
+  const inc = (deps.included ?? includedRouters)(cfg);
+  const stk = (deps.stacks ?? stackRouters)(cfg);
   return {
     org: cfg.org,
     container: n.container,
@@ -62,13 +111,24 @@ export function edgeStatus(
     ports: cfg.ports,
     network: n.network,
     domains: edgeDomains(cfg),
-    routes: Object.entries(cfg.routes).map(([name, upstream]) => ({
-      name,
-      url: routeUrl(name, cfg),
-      upstream,
-    })),
-    certNames: issued ?? certNames(cfg),
+    routes: edgeRoutes(cfg),
+    certNames: issued ?? (cfg.tls.strategy === "none" ? [] : certNames(cfg)),
     certIssued: issued !== null,
-    caTrusted: deps.caTrusted(cfg),
+    caTrusted: cfg.tls.strategy === "none" ? null : deps.caTrusted(cfg),
+    tls: {
+      strategy: cfg.tls.strategy,
+      implicit: cfg.tlsFrom === "implicit",
+      from: cfg.tlsFrom,
+      ca:
+        cfg.tls.strategy === "mkcert"
+          ? caDir(cfg)
+          : cfg.tls.strategy === "files"
+            ? cfg.tls.ca
+            : null,
+    },
+    included: inc.routers,
+    includedErrors: inc.errors,
+    stacks: stk.routers,
+    stackErrors: stk.errors,
   };
 }