@naviyra/cloud-panel 0.0.0-stage → 0.0.2

package/apps/agent/src/native-worker.mjs

@@ -0,0 +1,52 @@
+// An IPC watchdog owns the entire process tree. Agent exit/disconnect stops apps too.
+import { spawn } from "node:child_process";
+let child,
+  stopping = false;
+async function stop() {
+  if (stopping) return;
+  stopping = true;
+  if (child?.pid) {
+    if (process.platform === "win32")
+      await new Promise((resolve) => {
+        const killer = spawn(
+          `${process.env.SystemRoot || "C:\\Windows"}\\System32\\taskkill.exe`,
+          ["/PID", String(child.pid), "/T", "/F"],
+          { windowsHide: true, stdio: "ignore" },
+        );
+        killer.on("error", resolve);
+        killer.on("close", resolve);
+      });
+    else {
+      try {
+        process.kill(-child.pid, "SIGKILL");
+      } catch {}
+    }
+  }
+  process.exit(0);
+}
+process.on("disconnect", stop);
+process.on("SIGTERM", stop);
+process.on("SIGINT", stop);
+process.on("message", (message) => {
+  if (message.stop) return void stop();
+  if (child || !message.spec) return;
+  const { file, args, cwd, env } = message.spec;
+  child = spawn(file, args, {
+    cwd,
+    env,
+    windowsHide: true,
+    shell: false,
+    detached: process.platform !== "win32",
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  child.stdout.pipe(process.stdout);
+  child.stderr.pipe(process.stderr);
+  child.on("error", (error) => {
+    process.stderr.write(error.message);
+    process.exit(1);
+  });
+  child.on("exit", (code) => {
+    if (!stopping) process.exit(code ?? 1);
+  });
+  process.send?.({ started: true, pid: child.pid });
+});

package/apps/agent/src/native.mjs

@@ -0,0 +1,457 @@
+import { spawn, fork } from "node:child_process";
+import { existsSync } from "node:fs";
+import {
+  readFile,
+  writeFile,
+  mkdir,
+  readdir,
+  access,
+  realpath,
+} from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+import os from "node:os";
+import net from "node:net";
+const windows = process.platform === "win32";
+const binaries = {
+  node: process.execPath,
+  git: process.env.GIT_BIN || "git",
+  python: process.env.PYTHON_BIN || (windows ? "python" : "python3"),
+  php: process.env.PHP_BIN || "php",
+  phpcgi: process.env.PHP_CGI_BIN || "php-cgi",
+  caddy: process.env.CADDY_BIN || "caddy",
+  go: process.env.GO_BIN || "go",
+  cloudflared: process.env.CLOUDFLARED_BIN || "cloudflared",
+};
+export function safeEnvironment(extra = {}) {
+  const env = {};
+  for (const key of [
+    "PATH",
+    "Path",
+    "SystemRoot",
+    "WINDIR",
+    "COMSPEC",
+    "PATHEXT",
+    "TEMP",
+    "TMP",
+    "HOME",
+    "USERPROFILE",
+    "APPDATA",
+    "LOCALAPPDATA",
+    "LANG",
+    "SSL_CERT_FILE",
+    "SSL_CERT_DIR",
+  ])
+    if (process.env[key]) env[key] = process.env[key];
+  return { ...env, GIT_TERMINAL_PROMPT: "0", PYTHONUNBUFFERED: "1", ...extra };
+}
+export async function nativeCommand(name, args, options = {}) {
+  const file = binaries[name];
+  if (!file) throw Error("Native command is not allowed");
+  return run(file, args, options);
+}
+export function run(
+  file,
+  args,
+  { cwd, env = safeEnvironment(), log = () => {}, timeout = 600000 } = {},
+) {
+  return new Promise((resolve, reject) => {
+    const worker = fork(
+      fileURLToPath(new URL("./native-worker.mjs", import.meta.url)),
+      [],
+      { env: safeEnvironment(), silent: true, windowsHide: true },
+    );
+    let output = "",
+      settled = false;
+    const timer = setTimeout(() => {
+      settled = true;
+      worker.send({ stop: true });
+      reject(Error("Native command timed out"));
+    }, timeout);
+    const collect = (chunk) => {
+      output = (output + chunk.toString()).slice(-100000);
+      log(chunk.toString());
+    };
+    worker.stdout.on("data", collect);
+    worker.stderr.on("data", collect);
+    worker.on("error", (error) => {
+      clearTimeout(timer);
+      if (!settled) reject(error);
+    });
+    worker.on("exit", (code) => {
+      clearTimeout(timer);
+      if (!settled) {
+        code === 0
+          ? resolve(output)
+          : reject(
+              Error(`${path.basename(file)} failed: ${output.slice(-3000)}`),
+            );
+      }
+    });
+    worker.send({ spec: { file, args, cwd, env } });
+  });
+}
+export class NativeSupervisor {
+  constructor(log, onFailure) {
+    this.children = new Map();
+    this.log = log;
+    this.onFailure = onFailure;
+  }
+  async start(key, spec, attempt = 0) {
+    await this.stop(key);
+    const worker = fork(
+      fileURLToPath(new URL("./native-worker.mjs", import.meta.url)),
+      [],
+      { env: safeEnvironment(), silent: true, windowsHide: true },
+    );
+    const record = { worker, spec, attempt, stopping: false, started: false };
+    this.children.set(key, record);
+    worker.stdout.on("data", (data) => this.log(key, data.toString()));
+    worker.stderr.on("data", (data) => this.log(key, data.toString()));
+    worker.on("message", (m) => {
+      if (m.started) record.started = true;
+    });
+    worker.on("error", (error) => this.log(key, error.message));
+    worker.on("exit", () => {
+      if (record.stopping) return;
+      record.started = false;
+      if (attempt < 3) {
+        this.log(key, `Process exited; restart attempt ${attempt + 1}/3`);
+        record.timer = setTimeout(
+          () =>
+            this.start(key, spec, attempt + 1).catch((error) =>
+              this.onFailure(key, error),
+            ),
+          2000,
+        );
+      } else {
+        this.children.delete(key);
+        this.onFailure(
+          key,
+          Error("Process stopped after three restart attempts"),
+        );
+      }
+    });
+    worker.send({ spec });
+  }
+  active(key) {
+    return !!this.children.get(key)?.started;
+  }
+  async stop(key) {
+    const record = this.children.get(key);
+    if (!record) return;
+    record.stopping = true;
+    clearTimeout(record.timer);
+    this.children.delete(key);
+    if (record.worker.exitCode !== null) return;
+    await new Promise((resolve) => {
+      record.worker.once("exit", resolve);
+      if (record.worker.connected) record.worker.send({ stop: true });
+      else resolve();
+    });
+  }
+  async stopProject(id) {
+    for (const key of [...this.children.keys()])
+      if (key.startsWith(`${id}:`)) await this.stop(key);
+  }
+  async shutdown() {
+    await Promise.all([...this.children.keys()].map((key) => this.stop(key)));
+  }
+}
+async function exists(file) {
+  try {
+    await access(file);
+    return true;
+  } catch {
+    return false;
+  }
+}
+export function npmCommand(args) {
+  const candidates = [
+    process.env.NPM_CLI_PATH,
+    process.env.npm_execpath,
+    path.join(
+      path.dirname(process.execPath),
+      "node_modules/npm/bin/npm-cli.js",
+    ),
+    "/usr/share/nodejs/npm/bin/npm-cli.js",
+    "/usr/local/lib/node_modules/npm/bin/npm-cli.js",
+    "/usr/lib/node_modules/npm/bin/npm-cli.js",
+  ].filter(Boolean);
+  const cli = candidates.find((file) => existsSync(file));
+  if (!cli)
+    throw Error(
+      "Cannot locate npm-cli.js. Set NPM_CLI_PATH to the installed npm CLI file.",
+    );
+  return {
+    file: process.execPath,
+    args: [cli, ...args],
+  };
+}
+export async function prepareNative(p, source, log = () => {}) {
+  const config = p.runtime_config || {};
+  const env = safeEnvironment({
+    PORT: String(p.port),
+    HOST: "127.0.0.1",
+    HOSTNAME: "127.0.0.1",
+    NODE_ENV: "production",
+  });
+  const execute = (file, args) => run(file, args, { cwd: source, env, log });
+  const npm = async (args) => {
+    const spec = npmCommand(args);
+    return execute(spec.file, spec.args);
+  };
+  const type = p.type || "nodejs";
+  if (type === "nodejs" || type === "static") {
+    if (await exists(path.join(source, "package.json"))) {
+      const manifest = JSON.parse(
+        await readFile(path.join(source, "package.json"), "utf8"),
+      );
+      if (type === "nodejs" && !manifest.scripts?.start)
+        throw Error("Node.js projects require a package.json start script");
+      await npm([
+        (await exists(path.join(source, "package-lock.json")))
+          ? "ci"
+          : "install",
+        "--include=dev",
+        "--no-audit",
+        "--no-fund",
+      ]);
+      if (manifest.scripts?.build) await npm(["run", "build"]);
+    } else if (type === "nodejs")
+      throw Error("package.json is missing at the source root");
+    if (type === "nodejs")
+      return [
+        { ...npmCommand(["run", "start"]), cwd: source, env, key: "app" },
+      ];
+    const root = await containedDirectory(source, config.public_dir || ".");
+    if (!(await exists(path.join(root, "index.html"))))
+      throw Error("Static public directory must contain index.html");
+    return [
+      {
+        key: "app",
+        file: process.execPath,
+        args: [
+          fileURLToPath(new URL("./static-server.mjs", import.meta.url)),
+          root,
+        ],
+        cwd: source,
+        env,
+      },
+    ];
+  }
+  if (type === "python") {
+    const venv = path.join(p.folder_path, "venv");
+    await execute(binaries.python, ["-m", "venv", venv]);
+    const python = path.join(
+      venv,
+      windows ? "Scripts/python.exe" : "bin/python",
+    );
+    if (await exists(path.join(source, "requirements.txt")))
+      await execute(python, ["-m", "pip", "install", "-r", "requirements.txt"]);
+    const wsgi = config.python_server === "wsgi";
+    await execute(python, [
+      "-m",
+      "pip",
+      "install",
+      wsgi ? "waitress" : "uvicorn",
+    ]);
+    return [
+      {
+        key: "app",
+        file: python,
+        args: wsgi
+          ? [
+              "-m",
+              "waitress",
+              `--listen=127.0.0.1:${p.port}`,
+              config.entrypoint || "app:app",
+            ]
+          : [
+              "-m",
+              "uvicorn",
+              config.entrypoint || "app:app",
+              "--host",
+              "127.0.0.1",
+              "--port",
+              String(p.port),
+            ],
+        cwd: source,
+        env,
+      },
+    ];
+  }
+  if (type === "go") {
+    const target = path.join(
+      p.folder_path,
+      windows ? "application.exe" : "application",
+    );
+    await execute(binaries.go, ["build", "-o", target, "."]);
+    return [{ key: "app", file: target, args: [], cwd: source, env }];
+  }
+  if (type === "php") {
+    if (await exists(path.join(source, "composer.json"))) {
+      if (!process.env.COMPOSER_PHAR)
+        throw Error("Set COMPOSER_PHAR to composer.phar for Composer projects");
+      await execute(binaries.php, [
+        process.env.COMPOSER_PHAR,
+        "install",
+        "--no-dev",
+        "--no-interaction",
+        "--prefer-dist",
+      ]);
+    }
+    const root = await containedDirectory(source, config.public_dir || ".");
+    const caddy = path.join(p.folder_path, "Caddyfile");
+    await writeFile(
+      caddy,
+      `{\n admin off\n auto_https off\n}\nhttp://127.0.0.1:${p.port} {\n root * ${JSON.stringify(root.replaceAll("\\", "/"))}\n @private path /.git/* /.env /composer.json /composer.lock\n respond @private 404\n php_fastcgi 127.0.0.1:${p.php_port}\n file_server {\n hide .* composer.json composer.lock\n }\n}\n`,
+    );
+    return [
+      {
+        key: "php",
+        file: binaries.phpcgi,
+        args: ["-b", `127.0.0.1:${p.php_port}`],
+        cwd: source,
+        env: { ...env, PHP_FCGI_MAX_REQUESTS: "0" },
+      },
+      {
+        key: "app",
+        file: binaries.caddy,
+        args: ["run", "--config", caddy, "--adapter", "caddyfile"],
+        cwd: source,
+        env,
+      },
+    ];
+  }
+  if (type === "custom") {
+    const allowed = JSON.parse(process.env.NATIVE_EXECUTABLES || "{}");
+    const file = allowed[config.executable];
+    if (typeof file !== "string" || !path.isAbsolute(file))
+      throw Error(
+        "Choose an executable alias configured by the host owner in NATIVE_EXECUTABLES",
+      );
+    return [
+      {
+        key: "app",
+        file,
+        args: (config.args || []).map((arg) =>
+          arg.replaceAll("{PORT}", String(p.port)),
+        ),
+        cwd: source,
+        env,
+      },
+    ];
+  }
+  throw Error("Unsupported native runtime");
+}
+export async function containedDirectory(source, relative) {
+  const base = await realpath(source),
+    target = await realpath(path.resolve(source, relative));
+  const rel = path.relative(base, target);
+  if (rel.startsWith("..") || path.isAbsolute(rel))
+    throw Error("Public directory escapes the project root");
+  return target;
+}
+export async function ready(port, supervisor, key) {
+  for (let i = 0; i < 60; i++) {
+    const listening = await new Promise((resolve) => {
+      const socket = net.connect(port, "127.0.0.1");
+      socket.setTimeout(500);
+      socket.once("connect", () => {
+        socket.destroy();
+        resolve(true);
+      });
+      socket.once("error", () => resolve(false));
+      socket.once("timeout", () => {
+        socket.destroy();
+        resolve(false);
+      });
+    });
+    if (listening && supervisor.active(key)) return;
+    await new Promise((resolve) => setTimeout(resolve, 500));
+  }
+  throw Error(
+    `Application did not start on port ${port}. Check the logs and required host runtimes.`,
+  );
+}
+export async function provisionNativeTunnel(runtime, p) {
+  if (process.env.NATIVE_TUNNELS === "false") {
+    // Retain existing tunnel metadata so a later delete can still clean up DNS.
+    p.tunnel ||= null;
+    runtime.log(p, "Local-only deployment: Cloudflare publishing is disabled.");
+    return;
+  }
+  const folder = path.join(runtime.root, "cloudflare");
+  await mkdir(folder, { recursive: true });
+  const credentials = path.join(folder, `${p.id}.json`),
+    config = path.join(folder, `${p.id}.yml`);
+  const cert =
+    process.env.CLOUDFLARE_CERT ||
+    path.join(os.homedir(), ".cloudflared", "cert.pem");
+  let credential;
+  if (await exists(credentials))
+    credential = JSON.parse(await readFile(credentials, "utf8"));
+  else {
+    await nativeCommand("cloudflared", [
+      "tunnel",
+      "--origincert",
+      cert,
+      "--credentials-file",
+      credentials,
+      "create",
+      `naviyra-${p.id}`,
+    ]);
+    credential = JSON.parse(await readFile(credentials, "utf8"));
+  }
+  p.tunnel = {
+    tunnel_id: credential.TunnelID,
+    tunnel_name: `naviyra-${p.id}`,
+    credentials_path: credentials,
+    config_path: config,
+  };
+  await runtime.save();
+  await writeFile(
+    config,
+    `tunnel: ${credential.TunnelID}\ncredentials-file: ${JSON.stringify(credentials)}\ningress:\n  - hostname: ${p.subdomain}\n    service: http://127.0.0.1:${p.port}\n  - service: http_status:404\n`,
+    { mode: 0o600 },
+  );
+  await nativeCommand("cloudflared", [
+    "tunnel",
+    "--origincert",
+    cert,
+    "route",
+    "dns",
+    credential.TunnelID,
+    p.subdomain,
+  ]);
+  const spec = {
+    key: "tunnel",
+    file: binaries.cloudflared,
+    args: ["tunnel", "--config", config, "run", credential.TunnelID],
+    cwd: runtime.root,
+    env: safeEnvironment(),
+  };
+  p.native_specs.push(spec);
+  await runtime.supervisor.start(`${p.id}:tunnel`, spec);
+}
+export async function deleteNativeTunnel(p) {
+  if (!p.tunnel) return;
+  const { deleteTunnelCname } = await import("./cloudflare.mjs");
+  await deleteTunnelCname(p.subdomain, p.tunnel.tunnel_id);
+  const prefix = [
+    "tunnel",
+    "--origincert",
+    process.env.CLOUDFLARE_CERT ||
+      path.join(os.homedir(), ".cloudflared", "cert.pem"),
+  ];
+  const tunnels = JSON.parse(
+    await nativeCommand("cloudflared", [...prefix, "list", "--output", "json"]),
+  );
+  if (tunnels.some((t) => t.id === p.tunnel.tunnel_id))
+    await nativeCommand("cloudflared", [
+      ...prefix,
+      "delete",
+      p.tunnel.tunnel_id,
+    ]);
+}