@or3/cloud 0.1.35 → 0.1.37

package/README.md

@@ -32,6 +32,8 @@ npx @or3/cloud init --public --domain cloud.example.com
 
 OR3 Cloud uses Caddy to obtain and renew HTTPS certificates. It does not
 change your DNS, firewall, Cloudflare, or Tailscale settings.
+The managed public profile forwards its proxy-trust setting into Nuxt runtime
+configuration so HTTPS API requests are not redirected back to themselves.
 
 ## Day-to-day commands
 
@@ -52,6 +54,10 @@ npx @or3/cloud restart
 
 Do not run `docker compose down --volumes` on a normal deployment: it deletes
 the application data. Use `backup` before an update or any destructive action.
+When an adopted legacy deployment used a different container UID, `update`
+rebuilds the data from its checksummed pre-update backup as the hardened
+runtime user. It does not recursively rewrite file ownership in place, and a
+failed migration restores the recorded legacy root owner and snapshot.
 For a destructive purge, export a fresh backup to a new directory on another
 filesystem first; `remove --purge-data --yes` verifies that export before it
 will delete anything.

package/assets/compose.yaml

@@ -8,6 +8,10 @@ services:
     environment:
       HOST: 0.0.0.0
       PORT: 3000
+      # Nuxt only applies nested runtime-config overrides from NUXT_* names.
+      # Bridge the managed OR3 setting so Caddy's sanitized forwarding headers
+      # are trusted and HTTPS enforcement cannot redirect back to itself.
+      NUXT_SECURITY_PROXY_TRUST_PROXY: "${OR3_TRUST_PROXY:-false}"
       OR3_BASIC_AUTH_DB_PATH: /data/auth.sqlite
       OR3_SQLITE_DB_PATH: /data/sync.sqlite
       OR3_STORAGE_FS_ROOT: /data/storage
@@ -54,9 +58,9 @@ services:
         - CMD-SHELL
         - >-
           if [ -x /nodejs/bin/node ]; then
-            exec /nodejs/bin/node -e "fetch('http://127.0.0.1:3000/api/health?deep=true').then(async r=>{const b=await r.json().catch(()=>({}));if(!r.ok||b.status!=='ok')process.exit(1)}).catch(()=>process.exit(1))";
+            exec /nodejs/bin/node -e "const fs=require('node:fs');try{fs.accessSync('/data',fs.constants.R_OK|fs.constants.W_OK);for(const p of [process.env.OR3_BASIC_AUTH_DB_PATH,process.env.OR3_SQLITE_DB_PATH].filter(Boolean)){const fd=fs.openSync(p,'r+');fs.closeSync(fd)}}catch{process.exit(1)}fetch('http://127.0.0.1:3000/api/health?deep=true').then(async r=>{const b=await r.json().catch(()=>({}));if(!r.ok||b.status!=='ok')process.exit(1)}).catch(()=>process.exit(1))";
           elif [ -x /usr/local/bin/node ]; then
-            exec /usr/local/bin/node -e "fetch('http://127.0.0.1:3000/api/health?deep=true').then(async r=>{const b=await r.json().catch(()=>({}));if(!r.ok||b.status!=='ok')process.exit(1)}).catch(()=>process.exit(1))";
+            exec /usr/local/bin/node -e "const fs=require('node:fs');try{fs.accessSync('/data',fs.constants.R_OK|fs.constants.W_OK);for(const p of [process.env.OR3_BASIC_AUTH_DB_PATH,process.env.OR3_SQLITE_DB_PATH].filter(Boolean)){const fd=fs.openSync(p,'r+');fs.closeSync(fd)}}catch{process.exit(1)}fetch('http://127.0.0.1:3000/api/health?deep=true').then(async r=>{const b=await r.json().catch(()=>({}));if(!r.ok||b.status!=='ok')process.exit(1)}).catch(()=>process.exit(1))";
           else exit 127; fi
       interval: 10s
       timeout: 5s

package/dist/cli.mjs

@@ -27,7 +27,7 @@ import { dirname, basename, isAbsolute, join, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createGunzip } from "node:zlib";
 var execFile = promisify(execFileCallback);
-var PACKAGE_VERSION = "0.1.35";
+var PACKAGE_VERSION = "0.1.37";
 var IMAGE_REPOSITORY = "ghcr.io/saluana/or3-chat";
 var ASSET_ROOT = resolve(fileURLToPath(new URL("../assets/", import.meta.url)));
 var STATE_SCHEMA_VERSION = 1;
@@ -489,11 +489,16 @@ async function assertSafeComposeBinding(directory, mode, env) {
     throw new Error("Resolved Compose configuration must publish OR3 port 3000 only on 127.0.0.1. Refusing to expose the application directly.");
   }
 }
-var HEALTH_SCRIPT = "fetch('http://127.0.0.1:3000/api/health?deep=true').then(async response=>{const body=await response.json().catch(()=>({}));if(!response.ok||body.status!=='ok')process.exit(1)}).catch(()=>process.exit(1))";
+var HEALTH_SCRIPT = "const fs=require('node:fs');try{fs.accessSync('/data',fs.constants.R_OK|fs.constants.W_OK);for(const path of [process.env.OR3_BASIC_AUTH_DB_PATH,process.env.OR3_SQLITE_DB_PATH].filter(Boolean)){const fd=fs.openSync(path,'r+');fs.closeSync(fd)}}catch{process.exit(1)}fetch('http://127.0.0.1:3000/api/health?deep=true').then(async response=>{const body=await response.json().catch(()=>({}));if(!response.ok||body.status!=='ok')process.exit(1)}).catch(()=>process.exit(1))";
 var MAINTENANCE_SCRIPT = "fetch('http://127.0.0.1:3000/api/health?deep=true').then(async response=>{const body=await response.json().catch(()=>({}));const m=body?.providers?.sync?.details?.maintenance;if(m)console.log(JSON.stringify(m))}).catch(()=>{})";
 var CONTAINER_NODE = "/nodejs/bin/node";
 var LEGACY_CONTAINER_NODE = "/usr/local/bin/node";
-var CONTAINER_HEALTH_SHELL = `if [ -x ${CONTAINER_NODE} ]; then exec ${CONTAINER_NODE} -e "$1"; elif [ -x ${LEGACY_CONTAINER_NODE} ]; then exec ${LEGACY_CONTAINER_NODE} -e "$1"; else exit 127; fi`;
+var CONTAINER_NODE_SHELL = `if [ -x ${CONTAINER_NODE} ]; then exec ${CONTAINER_NODE} -e "$1"; elif [ -x ${LEGACY_CONTAINER_NODE} ]; then exec ${LEGACY_CONTAINER_NODE} -e "$1"; else exit 127; fi`;
+var MANAGED_RUNTIME_UID = 65532;
+var MANAGED_RUNTIME_GID = 65532;
+function containerNodeCommand(script) {
+  return ["sh", "-c", CONTAINER_NODE_SHELL, "or3-node", script];
+}
 async function waitForDeepHealthWithArgs(composeCommand, directory, secrets = []) {
   const deadline = Date.now() + DEEP_HEALTH_TIMEOUT_MS;
   let lastError = "health check did not complete";
@@ -503,11 +508,7 @@ async function waitForDeepHealthWithArgs(composeCommand, directory, secrets = []
       "exec",
       "-T",
       "or3",
-      "sh",
-      "-c",
-      CONTAINER_HEALTH_SHELL,
-      "or3-health",
-      HEALTH_SCRIPT
+      ...containerNodeCommand(HEALTH_SCRIPT)
     ], directory);
     if (result.ok)
       return;
@@ -520,6 +521,65 @@ async function ensureDocker() {
   await requireCommand("docker", ["info"], "Docker Engine");
   await requireCommand("docker", ["compose", "version"], "Docker Compose v2");
 }
+async function managedVolumeRootOwnership(image, volume) {
+  const result = await run("docker", [
+    "run",
+    "--rm",
+    "--network",
+    "none",
+    "--read-only",
+    "--user",
+    "0:0",
+    "--cap-drop",
+    "ALL",
+    "-v",
+    `${volume}:/data:ro`,
+    "--entrypoint",
+    "sh",
+    image,
+    "-c",
+    "stat -c '%u:%g' /data"
+  ]);
+  if (!result.ok)
+    throw new Error(`Could not inspect managed volume ${volume}. ${result.stderr.trim()}`);
+  const match = result.stdout.trim().match(/^(\d+):(\d+)$/);
+  if (!match)
+    throw new Error(`Managed volume ${volume} returned an invalid root ownership value.`);
+  return { uid: Number(match[1]), gid: Number(match[2]) };
+}
+async function setManagedVolumeRootOwnership(image, volume, ownership) {
+  if (!Number.isSafeInteger(ownership.uid) || ownership.uid < 0 || !Number.isSafeInteger(ownership.gid) || ownership.gid < 0) {
+    throw new Error("Refusing an invalid managed volume root UID/GID.");
+  }
+  const result = await run("docker", [
+    "run",
+    "--rm",
+    "--network",
+    "none",
+    "--read-only",
+    "--user",
+    "0:0",
+    "--security-opt",
+    "no-new-privileges:true",
+    "--cap-drop",
+    "ALL",
+    "--cap-add",
+    "CHOWN",
+    "-v",
+    `${volume}:/data`,
+    "--entrypoint",
+    "sh",
+    image,
+    "-c",
+    `chown ${ownership.uid}:${ownership.gid} /data`
+  ]);
+  if (!result.ok)
+    throw new Error(`Could not set managed volume ${volume} root ownership. ${result.stderr.trim()}`);
+  const actual = await managedVolumeRootOwnership(image, volume);
+  if (actual.uid !== ownership.uid || actual.gid !== ownership.gid) {
+    throw new Error(`Managed volume ${volume} root ownership verification failed.`);
+  }
+}
 async function portAvailable(port) {
   return new Promise((resolvePromise) => {
     const server = createServer();
@@ -1657,12 +1717,34 @@ async function updateCommand(directory, flags) {
     const backup = await createBackup(loaded.directory, state, env);
     await updatePending(loaded.directory, state, { backupId: backup.backupId });
     const nextEnv = { ...env, OR3_VERSION: targetVersion, OR3_IMAGE: targetImage };
-    await writeSecure(deploymentPaths(loaded.directory).env, serializeEnv(nextEnv));
+    const previousRootOwnership = await managedVolumeRootOwnership(targetImage, state.volumeName);
+    const migrateLegacyVolume = previousRootOwnership.uid !== MANAGED_RUNTIME_UID || previousRootOwnership.gid !== MANAGED_RUNTIME_GID;
     try {
+      await stopProject(loaded.directory, state.mode);
+      if (migrateLegacyVolume) {
+        await setManagedVolumeRootOwnership(targetImage, state.volumeName, {
+          uid: MANAGED_RUNTIME_UID,
+          gid: MANAGED_RUNTIME_GID
+        });
+      }
+      await writeSecure(deploymentPaths(loaded.directory).env, serializeEnv(nextEnv));
+      if (migrateLegacyVolume) {
+        await restoreVolumeArchive(loaded.directory, state.mode, nextEnv, backup.backupDir);
+      }
       await startProject(loaded.directory, state.mode, nextEnv);
     } catch (error) {
       await writeSecure(deploymentPaths(loaded.directory).env, serializeEnv(oldEnv));
-      await restoreBackupData(loaded.directory, state, oldEnv, backup.backupDir);
+      try {
+        await stopProject(loaded.directory, state.mode).catch(() => {
+          return;
+        });
+        if (migrateLegacyVolume) {
+          await setManagedVolumeRootOwnership(targetImage, state.volumeName, previousRootOwnership);
+        }
+        await restoreBackupData(loaded.directory, state, oldEnv, backup.backupDir);
+      } catch (restoreError) {
+        throw new Error(`Update to ${targetVersion} failed, and automatic backup restoration also failed: ${restoreError instanceof Error ? restoreError.message : String(restoreError)}. Original update error: ${error instanceof Error ? error.message : String(error)}`);
+      }
       const oldDigest = await imageDigest(state.image);
       state.imageDigest = oldDigest;
       state.lastError = `Update to ${targetVersion} failed and was restored: ${redact(error instanceof Error ? error.message : String(error), secretValues(oldEnv))}`;
@@ -2316,9 +2398,7 @@ async function runCredentialsResetScript(directory, mode, values) {
       "-e",
       `OR3_RESET_ADMIN_PASSWORD=${values.adminPassword}`,
       "or3",
-      CONTAINER_NODE,
-      "-e",
-      script
+      ...containerNodeCommand(script)
     ])
   ], directory);
   if (!result.ok)
@@ -2339,9 +2419,7 @@ async function verifyCredentialsInsideContainer(directory, mode, values) {
       "-e",
       `OR3_RESET_ADMIN_PASSWORD=${values.adminPassword}`,
       "or3",
-      CONTAINER_NODE,
-      "-e",
-      CREDENTIALS_VERIFY_SCRIPT
+      ...containerNodeCommand(CREDENTIALS_VERIFY_SCRIPT)
     ])
   ], directory);
   if (!result.ok)
@@ -2451,7 +2529,7 @@ async function statusCommand(directory) {
   await printMaintenanceSummary(directory, state.mode);
 }
 async function printMaintenanceSummary(directory, mode) {
-  const result = await run("docker", [...composeArgs(directory, mode, ["exec", "-T", "or3", CONTAINER_NODE, "-e", MAINTENANCE_SCRIPT])], directory);
+  const result = await run("docker", [...composeArgs(directory, mode, ["exec", "-T", "or3", ...containerNodeCommand(MAINTENANCE_SCRIPT)])], directory);
   if (!result.ok || !result.stdout.trim())
     return;
   try {
@@ -2596,7 +2674,7 @@ ${result.stderr}`);
   console.log(`Purged: data volumes, backups, .env, managed state, and compose files were deleted. The verified export at ${exportReceipt.destination} is the remaining copy.`);
 }
 async function probeDeepHealth(directory, mode) {
-  const result = await run("docker", [...composeArgs(directory, mode, ["exec", "-T", "or3", CONTAINER_NODE, "-e", HEALTH_SCRIPT])], directory);
+  const result = await run("docker", [...composeArgs(directory, mode, ["exec", "-T", "or3", ...containerNodeCommand(HEALTH_SCRIPT)])], directory);
   if (result.ok)
     return "ok";
   const ps = await run("docker", [...composeArgs(directory, mode, ["ps", "-q", "or3"])], directory);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@or3/cloud",
-  "version": "0.1.35",
+  "version": "0.1.37",
   "description": "Install and operate the OR3 Cloud container distribution",
   "type": "module",
   "license": "GPL-3.0",