@omnitron-dev/omnitron 0.1.3 → 0.3.0

package/dist/infrastructure/presets/redis.js

@@ -11,13 +11,32 @@ export const redisPreset = {
     defaultPorts: { main: 6379 },
     defaultSecrets: {},
     defaultHealthCheck: {
+        // The naive `redis-cli ping` exits 0 even when redis is still
+        // loading its RDB and replies "LOADING Redis is loading the dataset
+        // in memory" — Docker's HEALTHCHECK then marks the container healthy
+        // and apps that try to connect get told their commands aren't
+        // accepted yet. The grep below requires the literal "PONG" reply,
+        // which redis only sends once it has fully loaded.
         type: 'command',
-        target: 'redis-cli ping',
-        interval: '5s',
-        timeout: '5s',
-        retries: 5,
+        target: 'sh -c "redis-cli ping | grep -q PONG"',
+        interval: '3s',
+        timeout: '3s',
+        retries: 30,
+    },
+    buildCommand(userConfig) {
+        const cfg = (userConfig['config'] ?? {});
+        const command = ['redis-server'];
+        command.push('--appendonly', cfg.appendonly === false ? 'no' : 'yes');
+        command.push('--maxmemory-policy', cfg.maxmemoryPolicy ?? 'allkeys-lru');
+        // No default. An eviction policy without a memory ceiling never evicts,
+        // so `maxmemory` was the one setting here that mattered — and it was the
+        // one the preset never passed at all, whatever the config said.
+        if (cfg.maxmemory)
+            command.push('--maxmemory', cfg.maxmemory);
+        return command;
     },
     defaultDocker: {
+        // Mirrors `buildCommand({})`.
         command: ['redis-server', '--appendonly', 'yes', '--maxmemory-policy', 'allkeys-lru'],
         volumes: {
             data: { target: '/data', source: '' },

package/dist/infrastructure/presets/redis.js.map

@@ -1 +1 @@
-{"version":3,"file":"redis.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/redis.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,CAAC,MAAM,WAAW,GAAmB;IACzC,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,OAAO;IACb,YAAY,EAAE,gBAAgB;IAC9B,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IAC5B,cAAc,EAAE,EAAE;IAElB,kBAAkB,EAAE;QAClB,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,gBAAgB;QACxB,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC;KACX;IAED,aAAa,EAAE;QACb,OAAO,EAAE,CAAC,cAAc,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,EAAE,aAAa,CAAC;QACrF,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;SACtC;KACF;IAED,oBAAoB;QAClB,OAAO;YACL,SAAS,EAAE,gCAAgC;SAC5C,CAAC;IACJ,CAAC;CACF,CAAC"}
+{"version":3,"file":"redis.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/redis.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,CAAC,MAAM,WAAW,GAAmB;IACzC,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,OAAO;IACb,YAAY,EAAE,gBAAgB;IAC9B,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IAC5B,cAAc,EAAE,EAAE;IAElB,kBAAkB,EAAE;QAClB,8DAA8D;QAC9D,oEAAoE;QACpE,qEAAqE;QACrE,8DAA8D;QAC9D,kEAAkE;QAClE,mDAAmD;QACnD,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,uCAAuC;QAC/C,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,EAAE;KACZ;IAED,YAAY,CAAC,UAAmC;QAC9C,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAItC,CAAC;QAEF,MAAM,OAAO,GAAG,CAAC,cAAc,CAAC,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtE,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,CAAC,eAAe,IAAI,aAAa,CAAC,CAAC;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,gEAAgE;QAChE,IAAI,GAAG,CAAC,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9D,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,aAAa,EAAE;QACb,8BAA8B;QAC9B,OAAO,EAAE,CAAC,cAAc,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,EAAE,aAAa,CAAC;QACrF,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;SACtC;KACF;IAED,oBAAoB;QAClB,OAAO;YACL,SAAS,EAAE,gCAAgC;SAC5C,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/infrastructure/presets/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAwB,MAAM,aAAa,CAAC;AAE7E,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;IAE7D,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAItC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAI7C,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B,IAAI,IAAI,MAAM,EAAE;IAIhB;;;OAGG;IACH,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,mBAAmB;CAkE/E"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAwB,MAAM,aAAa,CAAC;AAG7E,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;IAE7D,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAErC;IAED,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAE5C;IAED,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzB;IAED,IAAI,IAAI,MAAM,EAAE,CAEf;IAED;;;OAGG;IACH,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,mBAAmB,CAoJ7E;CACF"}

package/dist/infrastructure/presets/registry.js

@@ -4,6 +4,7 @@
  * Ships with built-in presets for common infrastructure.
  * Projects can register custom presets for specialized services.
  */
+import { renderTorrc, authorizedClientFiles } from './torrc.js';
 export class PresetRegistry {
     presets = new Map();
     register(preset) {
@@ -35,8 +36,41 @@ export class PresetRegistry {
                 mergedSecrets[k] = typeof v === 'string' ? v : v.secret;
             }
         }
-        // Merge ports
-        const mergedPorts = { ...preset.defaultPorts, ...config.ports };
+        // A preset's port is the CONTAINER's; a configured port is the host's.
+        //
+        // These were merged as one, so writing `ports: { http: 8080 }` for the
+        // openresty gateway declared that its nginx listens on 8080. It listens
+        // on 80 — that is a fact about the image, not something a config can
+        // change — so the container published 8080→8080 while the server was on
+        // 80, and every connection to it was refused. Measured on the gateway,
+        // where the health check reported unhealthy for a container that was
+        // serving an onion address correctly through a different path.
+        //
+        // The same distinction is right for the others and was accidentally
+        // harmless there: nobody changes the port Postgres listens on by editing
+        // a stack config, they change the one it is published at. `9000` for
+        // MinIO means "reach it at 9000", not "rebuild MinIO to listen
+        // elsewhere".
+        //
+        // So: the container port comes from the preset, and anything the config
+        // names becomes a host mapping — unless the preset never declared that
+        // port, in which case the config is describing a container port the
+        // preset does not know about, and it is one.
+        const containerPorts = { ...preset.defaultPorts };
+        const hostMappings = { ...config.docker?.portMappings };
+        for (const [name, port] of Object.entries(config.ports ?? {})) {
+            if (preset.defaultPorts[name] !== undefined) {
+                // The preset knows this port: the config is naming where to publish
+                // it. An explicit `portMappings` entry still wins — it says the same
+                // thing more precisely.
+                if (hostMappings[name] === undefined)
+                    hostMappings[name] = port;
+            }
+            else {
+                containerPorts[name] = port;
+            }
+        }
+        const mergedPorts = containerPorts;
         // Build Docker config: inject resolved secrets into environment
         const dockerEnv = { ...preset.defaultDocker.environment };
         // For postgres: POSTGRES_USER, POSTGRES_PASSWORD
@@ -50,20 +84,67 @@ export class PresetRegistry {
             dockerEnv['MINIO_ROOT_USER'] = mergedSecrets['accessKey'] ?? 'minioadmin';
             dockerEnv['MINIO_ROOT_PASSWORD'] = mergedSecrets['secretKey'] ?? 'minioadmin';
         }
+        else if (preset.name === 'tor') {
+            // The finished torrc, rendered here.
+            //
+            // It used to travel as a JSON list that a `jq` loop inside the
+            // container turned into torrc stanzas. That put the one file which
+            // decides whether a service is anonymous behind a shell script nobody
+            // could read without starting a container and nothing could test — and
+            // a hardening line dropped by a quoting mistake looks exactly like one
+            // that was never written.
+            const torCfg = (config.config ?? {});
+            const services = Array.isArray(torCfg.hiddenServices) ? torCfg.hiddenServices : [];
+            dockerEnv['OMNITRON_TORRC'] = renderTorrc({ services, extra: torCfg.extraTorrc });
+            // Client-authorization keys go to files tor reads out of each service
+            // directory, not into the torrc. A key that never reaches
+            // `authorized_clients/` is a restriction that silently does not exist.
+            const authFiles = authorizedClientFiles(services);
+            if (authFiles.length > 0) {
+                dockerEnv['OMNITRON_TOR_CLIENT_AUTH_JSON'] = JSON.stringify(authFiles);
+            }
+        }
         if (config.docker?.environment) {
             Object.assign(dockerEnv, config.docker.environment);
         }
-        // Merge Docker config
+        // Merge Docker config. The command comes from the preset's own builder
+        // when it has one, so the `config` block actually reaches the container;
+        // an explicit `docker.command` still wins, because a caller who spelled
+        // out the command means it.
+        const built = preset.buildCommand?.(config.config ?? {});
         const docker = {
             image: config.image ?? preset.defaultImage,
             ...preset.defaultDocker,
+            ...(built ? { command: built } : {}),
             ...config.docker,
+            // By key: a stack that adds a mount keeps the preset's. Spread whole,
+            // `docker.volumes` replaced them — the Tor preset's `/var/lib/tor`, its
+            // onion keys and so its address, would have gone the moment a stack
+            // gave Tor the gateway's socket to reach.
+            ...(preset.defaultDocker.volumes || config.docker?.volumes
+                ? { volumes: { ...preset.defaultDocker.volumes, ...config.docker?.volumes } }
+                : {}),
             environment: dockerEnv,
+            // Where each port is published, after the config's ports were read as
+            // host mappings rather than container ones.
+            ...(Object.keys(hostMappings).length > 0 ? { portMappings: hostMappings } : {}),
         };
         // Build health check — customize user secret (e.g., pg_isready -U <user>)
         let healthCheck = preset.defaultHealthCheck;
         if (preset.name === 'postgres' && mergedSecrets['user']) {
-            healthCheck = { ...healthCheck, target: `pg_isready -U ${mergedSecrets['user']}` };
+            // Parametrise the user, keep the check. This used to replace the whole
+            // target with `pg_isready -U <user>` — the exact check the preset
+            // spends a paragraph explaining is not good enough, because it returns
+            // 0 the moment the postmaster accepts connections, while WAL replay or
+            // extension creation may still be running. So configuring a user
+            // silently downgraded the health check to the one the preset warns
+            // against, and only for the deployments that configure a user.
+            const user = mergedSecrets['user'];
+            healthCheck = {
+                ...healthCheck,
+                type: 'command',
+                target: `sh -c "psql -U ${user} -d postgres -h /var/run/postgresql -tAc \\"SELECT 1\\" | grep -q 1"`,
+            };
         }
         if (preset.name === 'redis' && mergedSecrets['password']) {
             healthCheck = { ...healthCheck, type: 'command', target: `redis-cli -a ${mergedSecrets['password']} ping` };

package/dist/infrastructure/presets/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,MAAM,OAAO,cAAc;IACR,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAE7D,QAAQ,CAAC,MAAsB;QAC7B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,WAAmB,EAAE,MAA4B;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,CAAC,MAAM,kBAAkB,WAAW,KAAK;gBAC1E,sBAAsB,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/C,CAAC;QACJ,CAAC;QAED,kDAAkD;QAClD,MAAM,aAAa,GAA2B,EAAE,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3E,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpD,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,cAAc;QACd,MAAM,WAAW,GAAG,EAAE,GAAG,MAAM,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;QAEhE,gEAAgE;QAChE,MAAM,SAAS,GAA2B,EAAE,GAAG,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC;QAClF,iDAAiD;QACjD,kDAAkD;QAClD,8EAA8E;QAC9E,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,SAAS,CAAC,eAAe,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC;YACjE,SAAS,CAAC,mBAAmB,CAAC,GAAG,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC;QAC3E,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACnC,SAAS,CAAC,iBAAiB,CAAC,GAAG,aAAa,CAAC,WAAW,CAAC,IAAI,YAAY,CAAC;YAC1E,SAAS,CAAC,qBAAqB,CAAC,GAAG,aAAa,CAAC,WAAW,CAAC,IAAI,YAAY,CAAC;QAChF,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACtD,CAAC;QAED,sBAAsB;QACtB,MAAM,MAAM,GAAyB;YACnC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,YAAY;YAC1C,GAAG,MAAM,CAAC,aAAa;YACvB,GAAG,MAAM,CAAC,MAAM;YAChB,WAAW,EAAE,SAAS;SACvB,CAAC;QAEF,0EAA0E;QAC1E,IAAI,WAAW,GAAG,MAAM,CAAC,kBAAkB,CAAC;QAC5C,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,WAAW,GAAG,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,iBAAiB,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACrF,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;YACzD,WAAW,GAAG,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,aAAa,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAC9G,CAAC;QAED,MAAM,MAAM,GAAwB;YAClC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,WAAW;YAClB,GAAG,EAAE,MAAM,CAAC,oBAAoB,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,EAAE;YAC7D,WAAW;YACX,OAAO,EAAE,aAAa;YACtB,MAAM;YACN,OAAO,EAAE,MAAM,CAAC,MAAM;SACvB,CAAC;QACF,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAC1D,IAAI,MAAM,CAAC,MAAM;YAAE,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;QACxD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAyB,MAAM,YAAY,CAAC;AAEvF,MAAM,OAAO,cAAc;IACR,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAE7D,QAAQ,CAAC,MAAsB;QAC7B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,WAAmB,EAAE,MAA4B;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,CAAC,MAAM,kBAAkB,WAAW,KAAK;gBAC1E,sBAAsB,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/C,CAAC;QACJ,CAAC;QAED,kDAAkD;QAClD,MAAM,aAAa,GAA2B,EAAE,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3E,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpD,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,EAAE;QACF,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,wEAAwE;QACxE,uEAAuE;QACvE,qEAAqE;QACrE,+DAA+D;QAC/D,EAAE;QACF,oEAAoE;QACpE,yEAAyE;QACzE,qEAAqE;QACrE,+DAA+D;QAC/D,cAAc;QACd,EAAE;QACF,wEAAwE;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,6CAA6C;QAC7C,MAAM,cAAc,GAA2B,EAAE,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;QAC1E,MAAM,YAAY,GAA2B,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC;QAEhF,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9D,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC5C,oEAAoE;gBACpE,qEAAqE;gBACrE,wBAAwB;gBACxB,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,SAAS;oBAAE,YAAY,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YAClE,CAAC;iBAAM,CAAC;gBACN,cAAc,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,cAAc,CAAC;QAEnC,gEAAgE;QAChE,MAAM,SAAS,GAA2B,EAAE,GAAG,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC;QAClF,iDAAiD;QACjD,kDAAkD;QAClD,8EAA8E;QAC9E,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,SAAS,CAAC,eAAe,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC;YACjE,SAAS,CAAC,mBAAmB,CAAC,GAAG,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC;QAC3E,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACnC,SAAS,CAAC,iBAAiB,CAAC,GAAG,aAAa,CAAC,WAAW,CAAC,IAAI,YAAY,CAAC;YAC1E,SAAS,CAAC,qBAAqB,CAAC,GAAG,aAAa,CAAC,WAAW,CAAC,IAAI,YAAY,CAAC;QAChF,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACjC,qCAAqC;YACrC,EAAE;YACF,+DAA+D;YAC/D,mEAAmE;YACnE,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,0BAA0B;YAC1B,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAGlC,CAAC;YACF,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;YACnF,SAAS,CAAC,gBAAgB,CAAC,GAAG,WAAW,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;YAElF,sEAAsE;YACtE,0DAA0D;YAC1D,uEAAuE;YACvE,MAAM,SAAS,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,SAAS,CAAC,+BAA+B,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACtD,CAAC;QAED,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,4BAA4B;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,MAAM,GAAyB;YACnC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,YAAY;YAC1C,GAAG,MAAM,CAAC,aAAa;YACvB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,GAAG,MAAM,CAAC,MAAM;YAChB,sEAAsE;YACtE,wEAAwE;YACxE,oEAAoE;YACpE,0CAA0C;YAC1C,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO;gBACxD,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;gBAC7E,CAAC,CAAC,EAAE,CAAC;YACP,WAAW,EAAE,SAAS;YACtB,sEAAsE;YACtE,4CAA4C;YAC5C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChF,CAAC;QAEF,0EAA0E;QAC1E,IAAI,WAAW,GAAG,MAAM,CAAC,kBAAkB,CAAC;QAC5C,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,uEAAuE;YACvE,kEAAkE;YAClE,uEAAuE;YACvE,uEAAuE;YACvE,iEAAiE;YACjE,mEAAmE;YACnE,+DAA+D;YAC/D,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YACnC,WAAW,GAAG;gBACZ,GAAG,WAAW;gBACd,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,kBAAkB,IAAI,sEAAsE;aACrG,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;YACzD,WAAW,GAAG,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,aAAa,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAC9G,CAAC;QAED,MAAM,MAAM,GAAwB;YAClC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,WAAW;YAClB,GAAG,EAAE,MAAM,CAAC,oBAAoB,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,EAAE;YAC7D,WAAW;YACX,OAAO,EAAE,aAAa;YACtB,MAAM;YACN,OAAO,EAAE,MAAM,CAAC,MAAM;SACvB,CAAC;QACF,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAC1D,IAAI,MAAM,CAAC,MAAM;YAAE,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;QACxD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/infrastructure/presets/tor.d.ts

@@ -0,0 +1,112 @@
+/**
+ * Tor Hidden Service Preset
+ *
+ * Runs a Tor daemon configured for **hidden-service-only** operation —
+ * SocksPort/ORPort/ExitPolicy are all locked down so the container cannot
+ * be abused as a relay or open SOCKS proxy. Hidden services map onion
+ * addresses to backend services declared in `config.hiddenServices`.
+ *
+ * Design choices for industrial-grade anonymity:
+ *
+ *   - HiddenServiceVersion 3 (256-bit Ed25519, default in modern tor).
+ *   - SocksPort 0          → no client SOCKS proxy is opened.
+ *   - ClientOnly 0          → we are not relaying client circuits.
+ *   - ORPort 0 / DirPort 0  → not a relay, not a directory server.
+ *   - ExitPolicy reject *:* → never serve as exit node.
+ *   - DisableDebuggerAttachment 1 — prevents ptrace + similar leaks.
+ *   - HardwareAccel 1       — uses CPU AES-NI when available.
+ *   - SafeLogging 1         — log scrubbing of identifying info.
+ *   - HiddenServiceEnableIntroDoSDefense 1 — circuit-level rate limiting
+ *     against introduction-point flooding (tor 0.4.7+).
+ *   - HiddenServicePoWDefensesEnabled 1     — proof-of-work mitigation
+ *     for the introduction layer (tor 0.4.8+).
+ *
+ * Networking:
+ *
+ *   The container needs to reach backend services that may be running on
+ *   the host (e.g. omnitron's webapp via omnitron-nginx, or any user-bound
+ *   dev/prod service). We add `host.docker.internal` → `host-gateway` so
+ *   HiddenServicePort targets like `host.docker.internal:9800` work
+ *   identically on macOS, Linux, and Windows.
+ *
+ * State:
+ *
+ *   `/var/lib/tor` is a persistent volume — that's where hidden service
+ *   keys live (`<name>/hs_ed25519_secret_key`, `<name>/hostname`). Losing
+ *   that volume rotates the .onion address. CLI command `omnitron tor`
+ *   reads the hostname files via `docker exec`.
+ *
+ * Configuration in omnitron.config.ts:
+ *
+ *     services: {
+ *       tor: {
+ *         preset: 'tor',
+ *         config: {
+ *           hiddenServices: [
+ *             { name: 'webapp', virtualPort: 80, target: 'host.docker.internal:9800' },
+ *             { name: 'portal', virtualPort: 80, target: 'host.docker.internal:7080' },
+ *           ],
+ *         },
+ *       },
+ *     },
+ */
+import type { IServicePreset } from './types.js';
+/** User-provided per-hidden-service config. */
+export interface ITorHiddenServiceConfig {
+    /** Logical name — also the directory name under /var/lib/tor/. */
+    name: string;
+    /** Port advertised on the .onion address (clients connect here). */
+    virtualPort: number;
+    /** Backend address `host:port` that tor forwards plaintext traffic to. */
+    target: string;
+}
+/** User-provided tor preset config. */
+export interface ITorPresetConfig {
+    /** Hidden services to expose. Each gets its own .onion address. */
+    hiddenServices: ITorHiddenServiceConfig[];
+    /**
+     * Extra raw torrc lines appended verbatim. Use sparingly — most
+     * hardening is already applied by the preset.
+     */
+    extraTorrc?: string[];
+}
+/**
+ * Inline shell that installs tor (~5s on first run, cached afterward),
+ * generates a hardened torrc from `OMNITRON_TOR_HIDDEN_SERVICES_JSON`,
+ * and execs the daemon as the `tor` user.
+ *
+ * Why inline rather than a custom Dockerfile: keeps the preset hermetic.
+ * No image build step, no separate registry, no image-tag drift.
+ */
+/**
+ * Client-authorization keys, written where tor reads them — or the container
+ * stops.
+ *
+ * Each key goes to `<HiddenServiceDir>/authorized_clients/`, which tor reads
+ * at startup, and a key that does not arrive is a restriction that silently
+ * does not exist: the onion answers everyone. This was
+ *
+ *     apk add --no-cache jq >/dev/null 2>&1 || true
+ *     printf '%s' "$JSON" | jq -c '.[]' | while IFS= read -r f; do … done
+ *
+ * under `set -eu` and no `pipefail`. A jq that was not there (the `|| true`
+ * swallowed the failed install) or JSON it could not read failed IN FRONT of
+ * the pipe; the loop read nothing and ended 0, the pipeline's status was the
+ * loop's, `set -e` saw success — and `exec tor` started the service with no
+ * key in place. Fail-open, on the one setting whose whole purpose is to close.
+ *
+ * Now nothing here is in a pipeline whose failure could hide (the loop reads
+ * a here-document, in this shell), jq is required rather than hoped for, and
+ * the keys are counted: fewer written than configured stops the container.
+ * An onion that is down is better than one that was meant for a few and
+ * answers everyone. `-e` where a null must fail — a key's path or content —
+ * and not on the list itself: `jq -e '.[]'` answers an empty one with exit 4,
+ * which would stop, without a sentence, an onion restricted to nobody.
+ *
+ * Exported so the court can run exactly this text. It needs `set -eu -o
+ * pipefail` in effect, which ENTRYPOINT_SHELL sets; busybox `sh` in
+ * alpine:3.21 honours `pipefail` (measured: `false | cat` → 1).
+ */
+export declare const CLIENT_AUTH_SHELL = "# Client-authorization keys, when the service uses them.\nif [ -n \"${OMNITRON_TOR_CLIENT_AUTH_JSON:-}\" ]; then\n  command -v jq >/dev/null 2>&1 || apk add --no-cache jq >/dev/null 2>&1 || apk add jq >/dev/null 2>&1 || true\n  if ! command -v jq >/dev/null 2>&1; then\n    echo 'tor: client authorization is configured and there is no jq to write its keys; not starting an onion service without them' >&2\n    exit 1\n  fi\n  expected=$(printf '%s' \"$OMNITRON_TOR_CLIENT_AUTH_JSON\" | jq -e 'length')\n  entries=$(printf '%s' \"$OMNITRON_TOR_CLIENT_AUTH_JSON\" | jq -c '.[]')\n  written=0\n  while IFS= read -r f; do\n    [ -n \"$f\" ] || continue\n    path=$(printf '%s' \"$f\" | jq -er .path)\n    mkdir -p \"$(dirname \"$path\")\"\n    printf '%s' \"$f\" | jq -er .content > \"$path\"\n    chmod 600 \"$path\"\n    written=$((written + 1))\n  done <<CLIENT_AUTH_KEYS\n$entries\nCLIENT_AUTH_KEYS\n  if [ \"$written\" -ne \"$expected\" ]; then\n    echo \"tor: wrote $written of $expected client-authorization keys; not starting an onion service without them\" >&2\n    exit 1\n  fi\nfi\n";
+export declare const torPreset: IServicePreset;
+//# sourceMappingURL=tor.d.ts.map

package/dist/infrastructure/presets/tor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tor.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/tor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,+CAA+C;AAC/C,MAAM,WAAW,uBAAuB;IACtC,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,uCAAuC;AACvC,MAAM,WAAW,gBAAgB;IAC/B,mEAAmE;IACnE,cAAc,EAAE,uBAAuB,EAAE,CAAC;IAC1C;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;GAOG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,iBAAiB,wkCAyB7B,CAAC;AAiCF,eAAO,MAAM,SAAS,EAAE,cA0CvB,CAAC"}

package/dist/infrastructure/presets/tor.js

@@ -0,0 +1,185 @@
+/**
+ * Tor Hidden Service Preset
+ *
+ * Runs a Tor daemon configured for **hidden-service-only** operation —
+ * SocksPort/ORPort/ExitPolicy are all locked down so the container cannot
+ * be abused as a relay or open SOCKS proxy. Hidden services map onion
+ * addresses to backend services declared in `config.hiddenServices`.
+ *
+ * Design choices for industrial-grade anonymity:
+ *
+ *   - HiddenServiceVersion 3 (256-bit Ed25519, default in modern tor).
+ *   - SocksPort 0          → no client SOCKS proxy is opened.
+ *   - ClientOnly 0          → we are not relaying client circuits.
+ *   - ORPort 0 / DirPort 0  → not a relay, not a directory server.
+ *   - ExitPolicy reject *:* → never serve as exit node.
+ *   - DisableDebuggerAttachment 1 — prevents ptrace + similar leaks.
+ *   - HardwareAccel 1       — uses CPU AES-NI when available.
+ *   - SafeLogging 1         — log scrubbing of identifying info.
+ *   - HiddenServiceEnableIntroDoSDefense 1 — circuit-level rate limiting
+ *     against introduction-point flooding (tor 0.4.7+).
+ *   - HiddenServicePoWDefensesEnabled 1     — proof-of-work mitigation
+ *     for the introduction layer (tor 0.4.8+).
+ *
+ * Networking:
+ *
+ *   The container needs to reach backend services that may be running on
+ *   the host (e.g. omnitron's webapp via omnitron-nginx, or any user-bound
+ *   dev/prod service). We add `host.docker.internal` → `host-gateway` so
+ *   HiddenServicePort targets like `host.docker.internal:9800` work
+ *   identically on macOS, Linux, and Windows.
+ *
+ * State:
+ *
+ *   `/var/lib/tor` is a persistent volume — that's where hidden service
+ *   keys live (`<name>/hs_ed25519_secret_key`, `<name>/hostname`). Losing
+ *   that volume rotates the .onion address. CLI command `omnitron tor`
+ *   reads the hostname files via `docker exec`.
+ *
+ * Configuration in omnitron.config.ts:
+ *
+ *     services: {
+ *       tor: {
+ *         preset: 'tor',
+ *         config: {
+ *           hiddenServices: [
+ *             { name: 'webapp', virtualPort: 80, target: 'host.docker.internal:9800' },
+ *             { name: 'portal', virtualPort: 80, target: 'host.docker.internal:7080' },
+ *           ],
+ *         },
+ *       },
+ *     },
+ */
+/**
+ * Inline shell that installs tor (~5s on first run, cached afterward),
+ * generates a hardened torrc from `OMNITRON_TOR_HIDDEN_SERVICES_JSON`,
+ * and execs the daemon as the `tor` user.
+ *
+ * Why inline rather than a custom Dockerfile: keeps the preset hermetic.
+ * No image build step, no separate registry, no image-tag drift.
+ */
+/**
+ * Client-authorization keys, written where tor reads them — or the container
+ * stops.
+ *
+ * Each key goes to `<HiddenServiceDir>/authorized_clients/`, which tor reads
+ * at startup, and a key that does not arrive is a restriction that silently
+ * does not exist: the onion answers everyone. This was
+ *
+ *     apk add --no-cache jq >/dev/null 2>&1 || true
+ *     printf '%s' "$JSON" | jq -c '.[]' | while IFS= read -r f; do … done
+ *
+ * under `set -eu` and no `pipefail`. A jq that was not there (the `|| true`
+ * swallowed the failed install) or JSON it could not read failed IN FRONT of
+ * the pipe; the loop read nothing and ended 0, the pipeline's status was the
+ * loop's, `set -e` saw success — and `exec tor` started the service with no
+ * key in place. Fail-open, on the one setting whose whole purpose is to close.
+ *
+ * Now nothing here is in a pipeline whose failure could hide (the loop reads
+ * a here-document, in this shell), jq is required rather than hoped for, and
+ * the keys are counted: fewer written than configured stops the container.
+ * An onion that is down is better than one that was meant for a few and
+ * answers everyone. `-e` where a null must fail — a key's path or content —
+ * and not on the list itself: `jq -e '.[]'` answers an empty one with exit 4,
+ * which would stop, without a sentence, an onion restricted to nobody.
+ *
+ * Exported so the court can run exactly this text. It needs `set -eu -o
+ * pipefail` in effect, which ENTRYPOINT_SHELL sets; busybox `sh` in
+ * alpine:3.21 honours `pipefail` (measured: `false | cat` → 1).
+ */
+export const CLIENT_AUTH_SHELL = `# Client-authorization keys, when the service uses them.
+if [ -n "\${OMNITRON_TOR_CLIENT_AUTH_JSON:-}" ]; then
+  command -v jq >/dev/null 2>&1 || apk add --no-cache jq >/dev/null 2>&1 || apk add jq >/dev/null 2>&1 || true
+  if ! command -v jq >/dev/null 2>&1; then
+    echo 'tor: client authorization is configured and there is no jq to write its keys; not starting an onion service without them' >&2
+    exit 1
+  fi
+  expected=$(printf '%s' "$OMNITRON_TOR_CLIENT_AUTH_JSON" | jq -e 'length')
+  entries=$(printf '%s' "$OMNITRON_TOR_CLIENT_AUTH_JSON" | jq -c '.[]')
+  written=0
+  while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    path=$(printf '%s' "$f" | jq -er .path)
+    mkdir -p "$(dirname "$path")"
+    printf '%s' "$f" | jq -er .content > "$path"
+    chmod 600 "$path"
+    written=$((written + 1))
+  done <<CLIENT_AUTH_KEYS
+$entries
+CLIENT_AUTH_KEYS
+  if [ "$written" -ne "$expected" ]; then
+    echo "tor: wrote $written of $expected client-authorization keys; not starting an onion service without them" >&2
+    exit 1
+  fi
+fi
+`;
+const ENTRYPOINT_SHELL = `set -eu
+# A pipeline's status is its LAST command's. Without this, a command that
+# failed in front of a pipe was invisible to \`set -e\` — see CLIENT_AUTH_SHELL.
+set -o pipefail
+
+# Tor, from the distribution. The version this pins to is measured, not
+# assumed: \`docker run --rm alpine:3.21 sh -c 'apk add tor && tor --version'\`
+# answers 0.4.9.12, against 0.4.9.11 on 3.20. Onion-service anonymity
+# improves with the release — 0.4.7 added the layer-2/3 guards that blunt
+# guard discovery, 0.4.8 the PoW defences this config turns on — so the base
+# image is part of the security posture and not a detail.
+apk add --no-cache tor >/dev/null 2>&1 || apk add tor >/dev/null 2>&1
+
+mkdir -p /etc/tor /var/lib/tor
+
+# The torrc arrives finished. Nothing here assembles it, so there is no
+# quoting in the path between what omnitron decided and what tor reads.
+printf '%s\\n' "$OMNITRON_TORRC" > /etc/tor/torrc
+
+${CLIENT_AUTH_SHELL}
+# Key material must be tor's and nobody else's; tor refuses to start on a
+# directory it does not own at 0700, which is the check working.
+chown -R tor:tor /var/lib/tor 2>/dev/null || true
+chmod 700 /var/lib/tor
+
+# Run as root and let tor drop to the \`User tor\` in the config: Alpine has
+# neither su-exec nor gosu by default, and adding one to drop privileges a
+# second time buys nothing.
+exec tor -f /etc/tor/torrc
+`;
+export const torPreset = {
+    name: 'tor',
+    type: 'gateway',
+    defaultImage: 'alpine:3.21',
+    // No host-side ports: hidden services are reachable only via the Tor
+    // network. Exposing 9050 etc. would defeat the entire point.
+    defaultPorts: {},
+    defaultSecrets: {},
+    defaultHealthCheck: {
+        // Tor takes 30-90s to bootstrap an HS on first start. We watch for the
+        // hostname file to be written — that's the unambiguous signal that the
+        // hidden service has been published.
+        type: 'command',
+        target: 'pgrep tor >/dev/null && [ "$(ls /var/lib/tor 2>/dev/null | wc -l)" -gt 0 ] || exit 1',
+        interval: '15s',
+        timeout: '5s',
+        retries: 20,
+        startPeriod: '120s',
+    },
+    defaultDocker: {
+        command: ['sh', '-c', ENTRYPOINT_SHELL],
+        volumes: {
+            data: { source: '', target: '/var/lib/tor' },
+        },
+        // host-gateway lets the container reach host-bound services (vite dev
+        // server, omnitron-nginx published port) on every platform.
+        extraHosts: ['host.docker.internal:host-gateway'],
+        environment: {
+            // Key files are created by tor itself; a tight umask is what keeps
+            // them 0600 rather than whatever the image's default would give.
+            UMASK: '077',
+        },
+    },
+    generateEnvTemplates() {
+        // No app-facing env: backends remain agnostic to whether they're being
+        // accessed via Tor or directly. Use `omnitron tor` to inspect onions.
+        return {};
+    },
+};
+//# sourceMappingURL=tor.js.map

package/dist/infrastructure/presets/tor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tor.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/tor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAyBH;;;;;;;GAOG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;CAyBhC,CAAC;AAEF,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;EAmBvB,iBAAiB;;;;;;;;;;CAUlB,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAmB;IACvC,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,SAAS;IACf,YAAY,EAAE,aAAa;IAC3B,qEAAqE;IACrE,6DAA6D;IAC7D,YAAY,EAAE,EAAE;IAChB,cAAc,EAAE,EAAE;IAElB,kBAAkB,EAAE;QAClB,uEAAuE;QACvE,uEAAuE;QACvE,qCAAqC;QACrC,IAAI,EAAE,SAAS;QACf,MAAM,EACJ,sFAAsF;QACxF,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,MAAM;KACpB;IAED,aAAa,EAAE;QACb,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,CAAC;QACvC,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE;SAC7C;QACD,sEAAsE;QACtE,4DAA4D;QAC5D,UAAU,EAAE,CAAC,mCAAmC,CAAC;QACjD,WAAW,EAAE;YACX,mEAAmE;YACnE,iEAAiE;YACjE,KAAK,EAAE,KAAK;SACb;KACF;IAED,oBAAoB;QAClB,uEAAuE;QACvE,sEAAsE;QACtE,OAAO,EAAE,CAAC;IACZ,CAAC;CACF,CAAC"}

package/dist/infrastructure/presets/torrc.d.ts

@@ -0,0 +1,54 @@
+/**
+ * The torrc an onion service runs on, and why each line is in it.
+ *
+ * Built here rather than by shell inside the container. The previous version
+ * assembled it with `cat`, `jq` and a `while read` loop at runtime, which
+ * meant the one file that decides whether a service is anonymous could not
+ * be read without starting a container, and could not be tested at all. A
+ * hardening option that is silently dropped by a quoting mistake looks
+ * exactly like one that was never asked for.
+ *
+ * Everything here is a real Tor option, checked against `tor --version`
+ * 0.4.9.12 — the newest in Alpine 3.21, measured rather than assumed.
+ *
+ * The threat this is written against: an adversary who wants to learn which
+ * host runs the service, or to make it stop. Not an adversary who has the
+ * host — that one has the keys, and no torrc helps.
+ */
+export interface TorHiddenService {
+    /** Directory name under /var/lib/tor, and the name `omnitron tor` prints. */
+    name: string;
+    /** Port clients reach on the .onion address. */
+    virtualPort: number;
+    /** `host:port` tor forwards plaintext to. */
+    target: string;
+    /**
+     * Public keys allowed to reach this service, as `<name>:descriptor:x25519:<base32>`.
+     *
+     * v3 client authorization, and the strongest privacy control an onion
+     * service has: without a listed key a client cannot decrypt the
+     * descriptor, so the service is not merely closed to them — it is
+     * undiscoverable. The cost is that every legitimate client needs the
+     * matching private key installed, so it is off unless asked for.
+     */
+    authorizedClients?: string[] | undefined;
+}
+export interface TorrcInputs {
+    services: readonly TorHiddenService[];
+    /** Appended verbatim, last, so an operator can always have the final word. */
+    extra?: readonly string[] | undefined;
+}
+export declare function renderTorrc(inputs: TorrcInputs): string;
+/**
+ * The `.auth` files that make client authorization real.
+ *
+ * Returned separately from the torrc because they are not torrc lines: tor
+ * reads them from `<HiddenServiceDir>/authorized_clients/`, and a key that
+ * never reaches that directory is a restriction that silently does not
+ * exist.
+ */
+export declare function authorizedClientFiles(services: readonly TorHiddenService[]): Array<{
+    path: string;
+    content: string;
+}>;
+//# sourceMappingURL=torrc.d.ts.map

package/dist/infrastructure/presets/torrc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"torrc.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/torrc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,WAAW,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAC1C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACtC,8EAA8E;IAC9E,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACvC;AAkBD,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAmIvD;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,GACpC,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAa1C"}