@naviyra/cloud-panel 0.0.0-stage → 0.0.2

package/apps/agent/src/runtime.mjs

@@ -0,0 +1,760 @@
+import { spawn } from "node:child_process";
+import {
+  mkdir,
+  readFile,
+  writeFile,
+  rename,
+  rm,
+  readdir,
+  chmod,
+} from "node:fs/promises";
+import path from "node:path";
+import net from "node:net";
+import os from "node:os";
+import { randomUUID } from "node:crypto";
+import yauzl from "yauzl";
+import {
+  NativeSupervisor,
+  nativeCommand,
+  prepareNative,
+  ready,
+  provisionNativeTunnel,
+  deleteNativeTunnel,
+} from "./native.mjs";
+
+const binaries = {
+  git: "/usr/bin/git",
+  npm: "/usr/bin/npm",
+  systemctl: "/usr/bin/systemctl",
+  journalctl: "/usr/bin/journalctl",
+  chown: "/usr/bin/chown",
+  runuser: "/usr/sbin/runuser",
+  cloudflared: process.env.CLOUDFLARED_BIN || "/usr/local/bin/cloudflared",
+};
+export function command(name, args, options = {}) {
+  if (!Object.hasOwn(binaries, name)) throw Error("Command is not allowed");
+  return new Promise((resolve, reject) => {
+    const child = spawn(binaries[name], args, {
+      cwd: options.cwd,
+      shell: false,
+      env: { ...process.env, GIT_TERMINAL_PROMPT: "0" },
+      stdio: ["ignore", "pipe", "pipe"],
+      detached: process.platform !== "win32",
+    });
+    let output = "";
+    let timedOut = false;
+    const stop = () => {
+      try {
+        if (process.platform !== "win32") process.kill(-child.pid, "SIGKILL");
+        else child.kill("SIGKILL");
+      } catch {}
+    };
+    const timer = setTimeout(() => {
+      timedOut = true;
+      stop();
+    }, options.timeout || 120000);
+    const collect = (data) => {
+      output = (output + data.toString()).slice(-100000);
+      options.onOutput?.(data.toString());
+    };
+    child.stdout.on("data", collect);
+    child.stderr.on("data", collect);
+    child.on("error", (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      code === 0 && !timedOut
+        ? resolve(output)
+        : reject(
+            Error(
+              `${name} ${timedOut ? "timed out" : `exited ${code}`}: ${output.slice(-3000)}`,
+            ),
+          );
+    });
+  });
+}
+
+export async function extractZip(buffer, destination) {
+  await mkdir(destination, { recursive: true });
+  return new Promise((resolve, reject) => {
+    yauzl.fromBuffer(
+      buffer,
+      { lazyEntries: true, validateEntrySizes: true },
+      (error, zip) => {
+        if (error) return reject(error);
+        let total = 0,
+          count = 0;
+        const fail = (error) => {
+          zip.close();
+          reject(error);
+        };
+        zip.on("error", fail);
+        zip.on("end", resolve);
+        zip.on("entry", async (entry) => {
+          try {
+            const filename = entry.fileName;
+            const target = path.resolve(destination, filename);
+            const rel = path.relative(destination, target);
+            if (
+              !rel ||
+              rel.startsWith("..") ||
+              path.isAbsolute(rel) ||
+              filename.includes("\\") ||
+              filename.includes(":") ||
+              ((entry.externalFileAttributes >>> 16) & 0xf000) === 0xa000
+            )
+              throw Error("Unsafe ZIP entry");
+            if (
+              filename
+                .split("/")
+                .some((p) => ["node_modules", ".git"].includes(p))
+            )
+              throw Error("Remove node_modules and .git from the archive");
+            if (
+              ++count > 10000 ||
+              (total += entry.uncompressedSize) > 200 * 1024 * 1024
+            )
+              throw Error("ZIP exceeds extraction limit");
+            if (filename.endsWith("/")) {
+              await mkdir(target, { recursive: true });
+              zip.readEntry();
+              return;
+            }
+            await mkdir(path.dirname(target), { recursive: true });
+            zip.openReadStream(entry, async (error, stream) => {
+              if (error) return fail(error);
+              try {
+                const chunks = [];
+                for await (const chunk of stream) chunks.push(chunk);
+                await writeFile(target, Buffer.concat(chunks), {
+                  flag: "wx",
+                  mode: 0o644,
+                });
+                zip.readEntry();
+              } catch (error) {
+                fail(error);
+              }
+            });
+          } catch (error) {
+            fail(error);
+          }
+        });
+        zip.readEntry();
+      },
+    );
+  });
+}
+
+export class Runtime {
+  constructor({ root, mode = "mock", portMin = 3100, portMax = 3999 }) {
+    if (!["mock", "host", "native"].includes(mode))
+      throw Error("AGENT_MODE must be mock, native or host");
+    if (mode === "host" && process.platform !== "linux")
+      throw Error("Host mode requires Linux");
+    if (
+      !Number.isInteger(portMin) ||
+      !Number.isInteger(portMax) ||
+      portMin < 1024 ||
+      portMax > 65535 ||
+      portMin > portMax
+    )
+      throw Error("Invalid port range");
+    this.root = path.resolve(root);
+    this.mode = mode;
+    this.portMin = portMin;
+    this.portMax = portMax;
+    this.state = { projects: {} };
+    this.tail = Promise.resolve();
+    this.jobs = Promise.resolve();
+    this.writes = Promise.resolve();
+    this.supervisor = new NativeSupervisor(
+      (key, message) => {
+        const p = this.state.projects[key.split(":")[0]];
+        if (p) this.log(p, message);
+      },
+      (key, error) => {
+        const p = this.state.projects[key.split(":")[0]];
+        if (p) {
+          p.status = "failed";
+          p.error = error.message;
+          this.log(p, error.message);
+          this.save().catch(console.error);
+        }
+      },
+    );
+    if (mode === "host" && !/^\/[a-zA-Z0-9/_-]+$/.test(this.root))
+      throw Error("Host root must be an absolute path without spaces");
+  }
+  async init() {
+    await mkdir(this.root, { recursive: true, mode: 0o700 });
+    if (this.mode === "host") await chmod(this.root, 0o711);
+    try {
+      this.state = JSON.parse(
+        await readFile(path.join(this.root, "state.json"), "utf8"),
+      );
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    for (const p of Object.values(this.state.projects)) {
+      p.backend ||= p.tunnel?.credentials_path ? "host" : "mock";
+      p.type ||= "nodejs";
+    }
+    for (const p of Object.values(this.state.projects))
+      if (["queued", "deploying"].includes(p.status)) {
+        p.status = "failed";
+        p.error = "Agent interrupted during deployment. Redeploy to retry.";
+      }
+    await this.save();
+    if (this.mode === "native")
+      for (const p of Object.values(this.state.projects)) {
+        if (
+          p.backend === "native" &&
+          p.status === "running" &&
+          p.native_specs?.length
+        ) {
+          this.jobs = this.jobs.then(async () => {
+            try {
+              for (const spec of p.native_specs.filter(
+                (spec) =>
+                  spec.key !== "tunnel" ||
+                  process.env.NATIVE_TUNNELS !== "false",
+              ))
+                await this.supervisor.start(`${p.id}:${spec.key}`, spec);
+              await ready(p.port, this.supervisor, `${p.id}:app`);
+            } catch (error) {
+              p.status = "failed";
+              p.error = error.message;
+              await this.supervisor.stopProject(p.id);
+            }
+            await this.save();
+          });
+        }
+      }
+    return this;
+  }
+  async save() {
+    const write = this.writes.then(async () => {
+      const file = path.join(this.root, "state.json");
+      await writeFile(file + ".tmp", JSON.stringify(this.state, null, 2), {
+        mode: 0o600,
+      });
+      await rename(file + ".tmp", file);
+    });
+    this.writes = write.catch(() => {});
+    return write;
+  }
+  serial(fn) {
+    const task = this.tail.then(fn);
+    this.tail = task.catch(() => {});
+    return task;
+  }
+  get(id) {
+    const p = this.state.projects[id];
+    if (!p) throw Object.assign(Error("Project not found"), { status: 404 });
+    return p;
+  }
+  log(p, message) {
+    p.logs = (
+      (p.logs || "") + `[${new Date().toISOString()}] ${message}\n`
+    ).slice(-100000);
+  }
+  async create(id, input) {
+    if (this.state.projects[id]) return this.get(id);
+    if (
+      Object.values(this.state.projects).some(
+        (p) => p.name === input.name || p.subdomain === input.subdomain,
+      )
+    )
+      throw Object.assign(Error("Name or hostname already exists"), {
+        status: 409,
+      });
+    const p = {
+      ...input,
+      backend: this.mode,
+      id,
+      status: "created",
+      port: null,
+      logs: "",
+      folder_path: path.join(this.root, "projects", id),
+    };
+    this.state.projects[id] = p;
+    await this.save();
+    return p;
+  }
+  async allocate() {
+    const occupied = new Set(
+      Object.values(this.state.projects).flatMap((p) => [p.port, p.php_port]),
+    );
+    for (let port = this.portMin; port <= this.portMax; port++) {
+      if (occupied.has(port)) continue;
+      const free = await new Promise((resolve) => {
+        const server = net.createServer();
+        server.once("error", () => resolve(false));
+        server.listen(port, "127.0.0.1", () =>
+          server.close(() => resolve(true)),
+        );
+      });
+      if (free) return port;
+    }
+    throw Error("No ports available in the configured range");
+  }
+  async upload(id, buffer) {
+    const p = this.get(id);
+    if (["queued", "deploying"].includes(p.status))
+      throw Object.assign(Error("Deployment in progress"), { status: 409 });
+    await writeFile(path.join(this.root, `${id}.zip`), buffer, { mode: 0o600 });
+    p.has_upload = true;
+    await this.save();
+  }
+  async deploy(id, deploymentId) {
+    const p = this.get(id);
+    if (this.mode === "host" && p.type && p.type !== "nodejs")
+      throw Error("Use AGENT_MODE=native for multiple runtimes");
+    if (p.backend && p.backend !== this.mode && p.backend !== "mock")
+      throw Error(
+        "Project belongs to another deployment backend. Switch to its original agent mode to manage it.",
+      );
+    if (p.backend === "mock" && this.mode !== "mock") {
+      p.tunnel = null;
+      p.native_specs = [];
+    }
+    p.backend = this.mode;
+    if (p.deployment_id === deploymentId) return p;
+    if (["queued", "deploying"].includes(p.status))
+      throw Object.assign(Error("Deployment already in progress"), {
+        status: 409,
+      });
+    if (p.source_type === "zip" && !p.has_upload)
+      throw Error("Upload a ZIP before deploying");
+    p.status = "queued";
+    p.deployment_id = deploymentId;
+    p.error = null;
+    await this.save();
+    // Builds run serially without blocking short API mutations for other projects.
+    this.jobs = this.jobs
+      .then(() => this.pipeline(p))
+      .catch((error) => {
+        p.status = "failed";
+        p.error = error.message;
+        console.error("Unable to persist deployment state:", error.message);
+      });
+    return p;
+  }
+  async pipeline(p) {
+    try {
+      p.status = "deploying";
+      p.port ||= await this.allocate();
+      this.log(p, `Starting deployment ${p.deployment_id}`);
+      await this.save();
+      if (this.mode === "mock") {
+        for (const step of [
+          "Source received",
+          "Port allocated: " + p.port,
+          "Dependencies installed (simulated)",
+          "Build completed (simulated)",
+          "App service started (simulated)",
+          "Cloudflare tunnel connected (simulated)",
+        ]) {
+          this.log(p, step);
+          await new Promise((r) => setTimeout(r, 150));
+        }
+        p.tunnel = {
+          tunnel_id: p.tunnel?.tunnel_id || randomUUID(),
+          tunnel_name: `naviyra-${p.id}`,
+          credentials_path: null,
+          config_path: null,
+        };
+      } else if (this.mode === "native") await this.nativeDeploy(p);
+      else await this.hostDeploy(p);
+      p.status = "running";
+      this.log(p, "Deployment complete");
+    } catch (error) {
+      p.status = "failed";
+      p.error = error.message;
+      this.log(p, `FAILED: ${error.message}`);
+      if (this.mode === "native") await this.supervisor.stopProject(p.id);
+      if (this.mode === "host")
+        for (const unit of [this.unit(p), this.unit(p, true)])
+          await command("systemctl", ["stop", unit]).catch(() => {});
+    }
+    await this.save();
+  }
+  unit(p, tunnel = false) {
+    return `naviyra-${p.id}${tunnel ? "-tunnel" : ""}.service`;
+  }
+  async nativeDeploy(p) {
+    await this.supervisor.stopProject(p.id);
+    const source = path.resolve(p.folder_path, "app");
+    const relative = path.relative(this.root, source);
+    if (relative.startsWith("..") || path.isAbsolute(relative))
+      throw Error("Project path escapes agent root");
+    await mkdir(p.folder_path, { recursive: true });
+    await rm(source, { recursive: true, force: true });
+    await mkdir(source, { recursive: true });
+    if (p.source_type === "zip")
+      await extractZip(
+        await readFile(path.join(this.root, `${p.id}.zip`)),
+        source,
+      );
+    else
+      await nativeCommand(
+        "git",
+        [
+          "-c",
+          "http.followRedirects=false",
+          "clone",
+          "--depth",
+          "1",
+          "--",
+          p.git_url,
+          source,
+        ],
+        { cwd: p.folder_path, log: (message) => this.log(p, message) },
+      );
+    if (p.type === "php") p.php_port ||= await this.allocate();
+    this.log(
+      p,
+      `Preparing native ${p.type || "nodejs"} runtime on ${process.platform}`,
+    );
+    p.native_specs = await prepareNative(p, source, (message) =>
+      this.log(p, message),
+    );
+    for (const spec of p.native_specs)
+      await this.supervisor.start(`${p.id}:${spec.key}`, spec);
+    await ready(p.port, this.supervisor, `${p.id}:app`);
+    if (p.type === "php")
+      await ready(p.php_port, this.supervisor, `${p.id}:php`);
+    await provisionNativeTunnel(this, p);
+  }
+  async hostDeploy(p) {
+    const user = process.env.APP_USER || "naviyra-app";
+    const group = process.env.APP_GROUP || user;
+    if (!/^[a-z_][a-z0-9_-]*$/.test(user) || !/^[a-z_][a-z0-9_-]*$/.test(group))
+      throw Error("Invalid app user or group");
+    const folder = p.folder_path;
+    const release = path.join(folder, "app");
+    await mkdir(path.join(this.root, "projects"), { recursive: true });
+    await chmod(path.join(this.root, "projects"), 0o711);
+    await command("systemctl", ["stop", this.unit(p)]).catch(() => {});
+    await mkdir(folder, { recursive: true, mode: 0o755 });
+    await rm(release, { recursive: true, force: true });
+    await mkdir(release, { recursive: true });
+    await command("chown", ["-R", `${user}:${group}`, folder]);
+    const asUser = async (binary, args, cwd = release) =>
+      command(
+        "runuser",
+        [
+          "-u",
+          user,
+          "--",
+          "/usr/bin/env",
+          "-i",
+          "PATH=/usr/local/bin:/usr/bin:/bin",
+          `HOME=${folder}`,
+          "GIT_TERMINAL_PROMPT=0",
+          binary,
+          ...args,
+        ],
+        { cwd, timeout: 600000, onOutput: (chunk) => this.log(p, chunk) },
+      );
+    if (p.source_type === "git")
+      await asUser(
+        binaries.git,
+        [
+          "-c",
+          "http.followRedirects=false",
+          "clone",
+          "--depth",
+          "1",
+          "--",
+          p.git_url,
+          release,
+        ],
+        folder,
+      );
+    else {
+      await extractZip(
+        await readFile(path.join(this.root, `${p.id}.zip`)),
+        release,
+      );
+      await command("chown", ["-R", `${user}:${group}`, release]);
+    }
+    const manifest = JSON.parse(
+      await readFile(path.join(release, "package.json"), "utf8"),
+    );
+    if (!manifest.scripts?.start)
+      throw Error(
+        "package.json must contain a start script at the archive/repository root",
+      );
+    const files = await readdir(release);
+    this.log(p, "Installing dependencies");
+    await asUser(binaries.npm, [
+      files.includes("package-lock.json") ? "ci" : "install",
+      "--no-audit",
+      "--no-fund",
+    ]);
+    if (manifest.scripts.build) {
+      this.log(p, "Building application");
+      await asUser(binaries.npm, ["run", "build"]);
+    }
+    const appUnit = `[Unit]\nDescription=Naviyra ${p.name}\nAfter=network.target\n[Service]\nUser=${user}\nGroup=${group}\nWorkingDirectory=${release}\nExecStart=/usr/bin/npm run start\nEnvironment=NODE_ENV=production\nEnvironment=PORT=${p.port}\nEnvironment=HOST=127.0.0.1\nEnvironment=HOSTNAME=127.0.0.1\nRestart=on-failure\nRestartSec=3\nNoNewPrivileges=true\nPrivateTmp=true\nProtectSystem=strict\nProtectHome=true\nReadWritePaths=${folder}\n[Install]\nWantedBy=multi-user.target\n`;
+    await writeFile(`/etc/systemd/system/${this.unit(p)}`, appUnit);
+    await mkdir(path.join(this.root, "cloudflare"), {
+      recursive: true,
+      mode: 0o700,
+    });
+    const credentials = path.join(this.root, "cloudflare", `${p.id}.json`);
+    const config = path.join(this.root, "cloudflare", `${p.id}.yml`);
+    const cert = process.env.CLOUDFLARE_CERT || "/root/.cloudflared/cert.pem";
+    if (!p.tunnel) {
+      // Recover a tunnel created before an interrupted state write using its credentials file.
+      let credential;
+      try {
+        credential = JSON.parse(await readFile(credentials, "utf8"));
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+      if (!credential) {
+        await command("cloudflared", [
+          "tunnel",
+          "--origincert",
+          cert,
+          "--credentials-file",
+          credentials,
+          "create",
+          `naviyra-${p.id}`,
+        ]);
+        credential = JSON.parse(await readFile(credentials, "utf8"));
+      }
+      p.tunnel = {
+        tunnel_id: credential.TunnelID,
+        tunnel_name: `naviyra-${p.id}`,
+        credentials_path: credentials,
+        config_path: config,
+      };
+      await this.save();
+    }
+    await writeFile(
+      config,
+      `tunnel: ${p.tunnel.tunnel_id}\ncredentials-file: ${credentials}\ningress:\n  - hostname: ${p.subdomain}\n    service: http://127.0.0.1:${p.port}\n  - service: http_status:404\n`,
+      { mode: 0o600 },
+    );
+    await command("cloudflared", [
+      "tunnel",
+      "--origincert",
+      cert,
+      "route",
+      "dns",
+      p.tunnel.tunnel_id,
+      p.subdomain,
+    ]);
+    const tunnelUnit = `[Unit]\nDescription=Naviyra tunnel ${p.name}\nAfter=network-online.target\nWants=network-online.target\n[Service]\nExecStart=${binaries.cloudflared} tunnel --config ${config} run ${p.tunnel.tunnel_id}\nRestart=on-failure\nRestartSec=5\n[Install]\nWantedBy=multi-user.target\n`;
+    await writeFile(`/etc/systemd/system/${this.unit(p, true)}`, tunnelUnit);
+    await command("systemctl", ["daemon-reload"]);
+    await command("systemctl", [
+      "enable",
+      "--now",
+      this.unit(p),
+      this.unit(p, true),
+    ]);
+    await command("systemctl", ["restart", this.unit(p), this.unit(p, true)]);
+    let ready = false;
+    for (let i = 0; i < 30; i++) {
+      ready = await new Promise((resolve) => {
+        const socket = net.connect(p.port, "127.0.0.1");
+        socket.setTimeout(1000);
+        socket.once("connect", () => {
+          socket.destroy();
+          resolve(true);
+        });
+        socket.once("error", () => resolve(false));
+        socket.once("timeout", () => {
+          socket.destroy();
+          resolve(false);
+        });
+      });
+      if (ready) break;
+      await new Promise((r) => setTimeout(r, 1000));
+    }
+    if (!ready)
+      throw Error(
+        "Application did not listen on its assigned PORT within 30 seconds",
+      );
+    await command("systemctl", ["is-active", this.unit(p), this.unit(p, true)]);
+  }
+  async restart(id) {
+    const p = this.get(id);
+    if (p.backend && p.backend !== this.mode)
+      throw Error(
+        "Switch the agent to the project deployment mode before restarting",
+      );
+    if (p.status !== "running")
+      throw Object.assign(Error("Only running projects can be restarted"), {
+        status: 409,
+      });
+    if (this.mode === "host")
+      await command("systemctl", ["restart", this.unit(p), this.unit(p, true)]);
+    if (this.mode === "native") {
+      await this.supervisor.stopProject(id);
+      for (const spec of (p.native_specs || []).filter(
+        (spec) =>
+          spec.key !== "tunnel" || process.env.NATIVE_TUNNELS !== "false",
+      ))
+        await this.supervisor.start(`${id}:${spec.key}`, spec);
+      await ready(p.port, this.supervisor, `${id}:app`);
+    }
+    this.log(p, "Services restarted");
+    await this.save();
+    return p;
+  }
+  async remove(id) {
+    const p = this.get(id);
+    if (p.backend && p.backend !== this.mode)
+      throw Error(
+        "Switch the agent to the project deployment mode before deleting",
+      );
+    if (["queued", "deploying"].includes(p.status))
+      throw Object.assign(Error("Wait for the deployment to finish"), {
+        status: 409,
+      });
+    if (this.mode === "native") {
+      await this.supervisor.stopProject(id);
+      try {
+        await deleteNativeTunnel(p);
+      } catch (error) {
+        p.status = "failed";
+        p.error = error.message;
+        await this.save();
+        throw error;
+      }
+    }
+    if (this.mode === "host") {
+      // Do not discard local state until all external cleanup succeeds; deletion is retryable.
+      if (p.tunnel) {
+        const { deleteTunnelCname } = await import("./cloudflare.mjs");
+        await deleteTunnelCname(p.subdomain, p.tunnel.tunnel_id);
+      }
+      for (const tunnel of [false, true]) {
+        const unit = this.unit(p, tunnel);
+        try {
+          await readFile(`/etc/systemd/system/${unit}`);
+          await command("systemctl", ["disable", "--now", unit]);
+          await rm(`/etc/systemd/system/${unit}`);
+        } catch (error) {
+          if (error.code !== "ENOENT") throw error;
+        }
+      }
+      await command("systemctl", ["daemon-reload"]);
+      if (p.tunnel) {
+        const prefix = [
+          "tunnel",
+          "--origincert",
+          process.env.CLOUDFLARE_CERT || "/root/.cloudflared/cert.pem",
+        ];
+        const tunnels = JSON.parse(
+          await command("cloudflared", [...prefix, "list", "--output", "json"]),
+        );
+        if (tunnels.some((t) => t.id === p.tunnel.tunnel_id))
+          await command("cloudflared", [
+            ...prefix,
+            "delete",
+            p.tunnel.tunnel_id,
+          ]);
+        p.tunnel = null;
+        await this.save();
+      }
+    }
+    await rm(p.folder_path, { recursive: true, force: true });
+    for (const file of [
+      `${id}.zip`,
+      `cloudflare/${id}.json`,
+      `cloudflare/${id}.yml`,
+    ])
+      await rm(path.join(this.root, file), { force: true });
+    delete this.state.projects[id];
+    await this.save();
+  }
+  async logs(id) {
+    const p = this.get(id);
+    let journal = "";
+    if (this.mode === "host" && p.port)
+      journal = await command("journalctl", [
+        "-u",
+        this.unit(p),
+        "-u",
+        this.unit(p, true),
+        "-n",
+        "120",
+        "--no-pager",
+        "-o",
+        "short-iso",
+      ]).catch((e) => e.message);
+    return { logs: (p.logs + "\n" + journal).slice(-100000) };
+  }
+  async metrics(id) {
+    const p = this.get(id);
+    if (this.mode === "native")
+      return {
+        mode: "native",
+        platform: process.platform,
+        active: this.supervisor.active(`${id}:app`),
+        tunnel_active: this.supervisor.active(`${id}:tunnel`),
+        memory_bytes: null,
+        cpu_nanoseconds: null,
+        metrics_available: false,
+        local_url: p.port ? `http://127.0.0.1:${p.port}` : null,
+      };
+    if (this.mode === "mock")
+      return {
+        mode: "mock",
+        active: p.status === "running",
+        tunnel_active: p.status === "running",
+        memory_bytes: 0,
+        cpu_nanoseconds: 0,
+      };
+    const values = await command("systemctl", [
+      "show",
+      this.unit(p),
+      "--property=ActiveState,MemoryCurrent,CPUUsageNSec",
+    ]);
+    const props = Object.fromEntries(
+      values
+        .trim()
+        .split("\n")
+        .map((line) => line.split("=")),
+    );
+    const tunnel = await command("systemctl", [
+      "is-active",
+      this.unit(p, true),
+    ]).catch(() => "inactive");
+    const numeric = (value) =>
+      Number.isSafeInteger(Number(value)) ? Number(value) : 0;
+    return {
+      mode: "host",
+      active: props.ActiveState === "active",
+      tunnel_active: tunnel.trim() === "active",
+      memory_bytes: numeric(props.MemoryCurrent),
+      cpu_nanoseconds: numeric(props.CPUUsageNSec),
+    };
+  }
+  systemMetrics() {
+    return {
+      mode: this.mode,
+      platform: process.platform,
+      runtimes:
+        this.mode === "host"
+          ? ["nodejs"]
+          : ["nodejs", "python", "php", "go", "static", "custom"],
+      tunnels_enabled:
+        this.mode === "native" ? process.env.NATIVE_TUNNELS !== "false" : true,
+      hostname: os.hostname(),
+      uptime: os.uptime(),
+      load: os.loadavg(),
+      memory_total: os.totalmem(),
+      memory_used: os.totalmem() - os.freemem(),
+      projects: Object.keys(this.state.projects).length,
+    };
+  }
+}