@ours.network/install 1.2.1-nightly.3 → 1.2.1-nightly.30

package/lib/gateway-transition.mjs

@@ -0,0 +1,87 @@
+import { existsSync, lstatSync, readFileSync, unlinkSync } from 'node:fs';
+import { join } from 'node:path';
+import { gatewayAddress } from './gateway.mjs';
+import { validateInstallation } from './plan.mjs';
+import { atomicWriteConfig, snapshotConfig, restoreConfig } from './config.mjs';
+
+// Called under the installation lock. No stored state or credentials are changed.
+export async function enableGateway(record, args, effects) {
+  validateInstallation(record, record.root);
+  if (record.mode !== 'docker' || record.schema !== 2 || record.buildTransition || record.layoutConversion)
+    throw new Error('Gateway migration requires a settled schema-2 Docker installation');
+  const journal = join(record.root, 'gateway-transition.json');
+  const recordPath = join(record.root, 'installation.json');
+  const profilePath = join(effects.home, '.ours-client', 'profile.json');
+  const paths = [recordPath, ...['docker-compose.gateway.yaml', 'nginx.conf', 'Dockerfile.gateway'].map(name => join(record.workDir, name)), profilePath];
+  const snapshot = path => {
+    if (existsSync(path)) {
+      const stat = lstatSync(path);
+      if (!stat.isFile() || stat.nlink !== 1 || stat.uid !== process.getuid() || (stat.mode & (path === profilePath || path === journal || path === recordPath ? 0o077 : 0o022)))
+        throw new Error('Gateway migration requires private owned configuration files');
+    }
+    return snapshotConfig(path);
+  };
+  async function rollback(saved) {
+    const phase = value => { saved.phase = value; atomicWriteConfig(journal, JSON.stringify(saved, null, 2) + '\n'); };
+    if (saved.phase === 'switching') phase('rollback-stopping');
+    if (saved.phase === 'rollback-stopping') {
+      await effects.serverLifecycle(saved.candidate, 'stop');
+      await effects.removeGatewayContainer(saved.candidate);
+      phase('rollback-restoring');
+    }
+    if (saved.phase === 'preparing') phase('rollback-restoring');
+    if (saved.phase === 'rollback-restoring') {
+      for (let i = 0; i < paths.length; i++) restoreConfig(paths[i], saved.snapshots[i]);
+      phase('rollback-restarting');
+    }
+    await effects.serverLifecycle(saved.original, 'start', saved.running);
+    unlinkSync(journal);
+  }
+  if (existsSync(journal)) {
+    snapshot(journal);
+    const saved = JSON.parse(readFileSync(journal, 'utf8'));
+    validateInstallation(saved.original, record.root);
+    validateInstallation(saved.candidate, record.root);
+    if (saved.schema !== 1 || !['preparing', 'switching', 'rollback-stopping', 'rollback-restoring', 'rollback-restarting'].includes(saved.phase) || !Array.isArray(saved.snapshots) || saved.snapshots.length !== paths.length
+        || !Array.isArray(saved.running) || saved.running.some(name => !saved.original.services.includes(name)))
+      throw new Error('Invalid retained gateway transition; operator recovery required');
+    await rollback(saved);
+    throw new Error('Interrupted gateway migration rolled back; repeat gateway-enable to begin a new migration');
+  }
+  if (record.gateway) {
+    if (args.serverUrl && args.serverUrl !== gatewayAddress(record).base) throw new Error('Gateway URL is already configured; refusing implicit URL replacement');
+    await effects.verifyGateway(record);
+    return record;
+  }
+  const candidate = { ...record, gateway: { version: 1, ...(args.serverUrl ? { serverUrl: args.serverUrl } : {}) }, services: [...record.services, 'gateway'] };
+  validateInstallation(candidate, record.root);
+  const current = effects.readManagedClientProfile();
+  const selected = current?.expectedInstanceId === record.instanceId && current.endpoint === `http://127.0.0.1:${record.port}`;
+  const saved = { schema: 1, phase: 'preparing', original: record, candidate, snapshots: paths.map(snapshot), running: await effects.serverLifecycle(record, 'status') };
+  // Reject old service artifacts before stopping the working deployment.
+  await effects.qualifyGatewayRuntime(candidate);
+  if (selected) await effects.qualifyInstalledGatewayClient(current);
+  atomicWriteConfig(journal, JSON.stringify(saved, null, 2) + '\n');
+  try {
+    await effects.prepareGateway(candidate);
+    saved.phase = 'switching';
+    atomicWriteConfig(journal, JSON.stringify(saved, null, 2) + '\n');
+    await effects.serverLifecycle(record, 'stop');
+    await effects.serverLifecycle(candidate, 'start', [...new Set([...saved.running, 'daemon', 'cowork', 'gateway'])]);
+    await effects.verifyGateway(candidate);
+    if (selected) {
+      const serverUrl = gatewayAddress(candidate).base;
+      atomicWriteConfig(profilePath, JSON.stringify({ ...current, serverUrl, endpoint: serverUrl + '/daemon' }, null, 2) + '\n');
+    }
+    // Preserve the running/stopped selection; gateway follows a running daemon.
+    const keep = [...saved.running, ...(saved.running.includes('daemon') ? ['gateway'] : [])];
+    await effects.serverLifecycle(candidate, 'stop', candidate.services.filter(name => !keep.includes(name)));
+    atomicWriteConfig(recordPath, JSON.stringify(candidate, null, 2) + '\n');
+    unlinkSync(journal);
+    return candidate;
+  } catch (cause) {
+    try { await rollback(saved); }
+    catch (rollbackError) { throw new AggregateError([cause, rollbackError], 'Gateway migration and rollback failed; retained journal requires gateway-enable recovery'); }
+    throw new Error('Gateway migration failed; previous routing, profile and service selection restored', { cause });
+  }
+}

package/lib/gateway.mjs

@@ -0,0 +1,142 @@
+/** One public URL; fixed same-origin service paths are never supplied by a peer. */
+export const GATEWAY_SERVICES = Object.freeze({daemon:'/daemon',cowork:'/cowork',telegram:'/tg-connector',messenger:'/messenger'});
+export function serverBase(value) {
+  if(typeof value!=='string'||/[\s\\?#]/.test(value)||!/^https?:\/\//.test(value))throw new Error('Server URL must be an HTTP or HTTPS base URL');
+  const url=new URL(value);
+  if(url.username||url.password)throw new Error('Server URL cannot contain credentials');
+  return url.origin+url.pathname.replace(/\/+$/,'');
+}
+export function gatewayDiscovery(record) {
+  return {schema:1,instanceId:record.instanceId,services:GATEWAY_SERVICES,capabilities:['ours.gateway-v1','cowork.http-management-v1']};
+}
+export function validateGatewayDiscovery(url,value,credentialPath) {
+  const base=serverBase(url);
+  if(value?.schema!==1||!/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/.test(value.instanceId??'')
+    ||!Array.isArray(value.capabilities)||!value.capabilities.includes('ours.gateway-v1')||!value.capabilities?.includes('cowork.http-management-v1')
+    ||Object.keys(GATEWAY_SERVICES).some(key=>value.services?.[key]!==GATEWAY_SERVICES[key]))throw new Error('Incompatible server gateway discovery');
+  return {serverUrl:base,endpoint:base+'/daemon',expectedInstanceId:value.instanceId,credentialPath};
+}
+export function gatewayAddress(record) {
+  const base = serverBase(record.gateway?.serverUrl ?? `http://127.0.0.1:${record.port}`);
+  const url = new URL(base);
+  if (!/^\/(?:[A-Za-z0-9_-]+\/)*[A-Za-z0-9_-]*$/.test(url.pathname)) throw new Error('Gateway base path must contain plain URL path segments');
+  return { base, origin: url.origin, prefix: url.pathname.replace(/\/$/, '') };
+}
+export function gatewayCompose(record) {
+  const { origin, prefix } = gatewayAddress(record);
+  return `services:
+  daemon:
+    ports: !reset []
+  telegram:
+    ports: !reset []
+    environment:
+      OURS_TG_CONTROL_HOST: "0.0.0.0"
+  cowork:
+    ports: !reset []
+    environment:
+      OURS_COWORK_HTTP_MANAGEMENT: "1"
+      OURS_COWORK_PUBLIC_ORIGIN: ${JSON.stringify(origin)}
+  messenger:
+    ports: !reset []
+    environment:
+      OURS_MESSENGER_PUBLIC_ORIGIN: ${JSON.stringify(origin)}
+      OURS_MESSENGER_BASE_PATH: ${JSON.stringify(prefix + "/messenger/")}
+  gateway:
+    image: "\${OURS_GATEWAY_IMAGE:-${record.project}:gateway}"
+    build:
+      context: .
+      dockerfile: Dockerfile.gateway
+    user: "101:101"
+    read_only: true
+    cap_drop: [ALL]
+    security_opt: [no-new-privileges:true]
+    tmpfs: ["/tmp:rw,nosuid,nodev,noexec,size=32m,mode=1777"]
+    networks: [ours]
+    ports:
+      - {target: 8080, published: "${record.port}", host_ip: "127.0.0.1"}
+    restart: unless-stopped
+    stop_grace_period: 10s
+    healthcheck:
+      test: [CMD, wget, -q, -O, /dev/null, http://127.0.0.1:8080/healthz]
+      interval: 5s
+      timeout: 3s
+      retries: 6
+`;
+}
+export function gatewayNginx(record) {
+  const { prefix: basePath } = gatewayAddress(record);
+  const routes=[['daemon',3050],['cowork',record.coworkPort??3052],['telegram',3051],['messenger',8420]];
+  const upstream=Object.fromEntries(routes);
+  for(const port of Object.values(upstream))if(!Number.isInteger(port)||port<1||port>65535)throw new Error('Invalid gateway upstream port');
+  const route=(name,servicePath)=> { const prefix=basePath+servicePath; return`location ${prefix}/ {
+      set $upstream_${name} http://${name}:${upstream[name]};
+      rewrite ^${prefix}/(.*)$ /$1 break;
+      proxy_pass $upstream_${name};
+      proxy_set_header Host $http_host;
+      proxy_set_header X-Forwarded-Proto $scheme;
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection $connection_upgrade;
+      proxy_http_version 1.1;
+      proxy_buffering off;
+      proxy_read_timeout 300s;
+    }`; };
+  return `worker_processes 1;
+pid /tmp/nginx.pid;
+error_log /dev/stderr warn;
+events { worker_connections 1024; }
+http {
+  access_log off;
+  client_body_temp_path /tmp/client;
+  proxy_temp_path /tmp/proxy;
+  fastcgi_temp_path /tmp/fastcgi;
+  uwsgi_temp_path /tmp/uwsgi;
+  scgi_temp_path /tmp/scgi;
+  proxy_next_upstream off;
+  resolver @@OURS_RESOLVERS@@ valid=5s;
+  map $http_upgrade $connection_upgrade { default upgrade; '' close; }
+  server {
+    listen 8080;
+    server_name _;
+    client_max_body_size 64m;
+    location = /healthz { return 200 'ok'; }
+    location = ${basePath}/.well-known/ours { default_type application/json; return 200 '${JSON.stringify(gatewayDiscovery(record))}'; }
+    location = / { return 302 ${basePath}/messenger/; }
+    location = ${basePath}/daemon { return 308 ${basePath}/daemon/; }
+    location = ${basePath}/cowork { return 308 ${basePath}/cowork/; }
+    location = ${basePath}/tg-connector { return 308 ${basePath}/tg-connector/; }
+    location = ${basePath}/messenger { return 308 ${basePath}/messenger/; }
+    # Never publish the unauthenticated loopback browser RPC. Management has its
+    # own application-level credential check and rejects browser-origin requests.
+    location = ${basePath}/cowork/rpc { return 403; }
+    location ${basePath}/cowork/management/ {
+      client_max_body_size 1m;
+      set $management http://cowork:${upstream.cowork};
+      rewrite ^${basePath}/cowork/(.*)$ /$1 break;
+      proxy_pass $management;
+      proxy_set_header Host $http_host;
+      proxy_http_version 1.1;
+      proxy_read_timeout 60s;
+    }
+    ${route('daemon','/daemon')}
+    ${route('cowork','/cowork')}
+    # Telegram's control API is local-only; no unauthenticated remote proxy.
+    location ${basePath}/tg-connector/ {
+      auth_request /_server_auth;
+      set $telegram http://telegram:3051;
+      rewrite ^${basePath}/tg-connector/(.*)$ /$1 break;
+      proxy_pass $telegram;
+    }
+    location = /_server_auth {
+      internal;
+      set $auth http://daemon:3050/identities;
+      proxy_pass $auth;
+      proxy_pass_request_body off;
+      proxy_set_header Content-Length "";
+      proxy_set_header X-Ours-Api-Token $http_x_ours_api_token;
+    }
+    ${route('messenger','/messenger')}
+    location / { return 404; }
+  }
+}
+`;
+}

package/lib/legacy-migration.mjs

@@ -17,6 +17,13 @@ function readJournal(root) {
   if (j.schema !== 1 || j.targetRoot !== root || !phases.includes(j.phase) || !Array.isArray(j.identities)) throw new Error('Invalid legacy migration journal');
   return j;
 }
+// Legacy cutover publishes a Docker/package launcher; Podman cutover is not supported.
+function rejectPodmanMigration(options, effects, ...records) {
+  if (options.containerEngine === 'podman' || records.some(record => record?.containerEngine === 'podman')
+      || effects.readJson(join(options.stateDir, 'installation.json'))?.containerEngine === 'podman') {
+    throw new Error('Legacy migration to Podman is not supported. Use a fresh Podman installation or migrate with Docker/packages.');
+  }
+}
 function selection(source) {
   return { env: { OURS_CONFIG: source.configPath, OURS_STATE_DIR: source.stateDir, OURS_PORT: String(source.config.port ?? 3050), OURS_API_TOKEN: undefined, OURS_DAEMON_ID: undefined, OURS_DAEMON_URL: undefined, OURS_DAEMON_CREDENTIAL_PATH: undefined }, sensitive: true };
 }
@@ -31,10 +38,11 @@ function validateIdentities(rows, source) {
 }
 
 export async function inspectLegacyMigration(options, effects, deps = {}) {
+  const journal = readJournal(options.stateDir);
+  rejectPodmanMigration(options, effects, journal?.record, options.legacyPlan?.journal?.record);
   const inspect = deps.inspectLegacyState ?? inspectLegacyState;
   await (deps.ensureLegacyLockSupport ?? ensureLegacyLockSupport)();
   const cliPlan = options.dryRun ? null : await (deps.inspectManagedCli ?? inspectManagedCli)(effects, options.stateDir);
-  const journal = readJournal(options.stateDir);
   if (journal) {
     if (journal.sourceConfig !== options.migrateFrom) throw new Error('Another legacy source is already selected for this target');
     return { journal, cliPlan, source: journal.phase === 'complete' ? null : { ...inspect(options.migrateFrom, options.stateDir), originalProgram: cliPlan?.originalProgram } };
@@ -80,12 +88,15 @@ export async function prepareMigrationCliRuntime(record, effects) {
 
 /** Called under the normal installation lock; retries never overwrite imported state. */
 export async function executeLegacyMigration(args, effects, install, deps = {}) {
+  const retainedJournal = readJournal(args.stateDir);
+  rejectPodmanMigration(args, effects, retainedJournal?.record, args.legacyPlan?.journal?.record);
   const stage = deps.stageLegacyState ?? stageLegacyState;
   const lock = deps.withLegacyStateLock ?? withLegacyStateLock;
   const save = (root, value) => (deps.atomicWriteConfig ?? atomicWriteConfig)(journalPath(root), JSON.stringify(value, null, 2) + '\n');
   const prepareCli = deps.prepareMigrationCliRuntime ?? prepareMigrationCliRuntime;
   const inspected = args.legacyPlan ?? await inspectLegacyMigration(args, effects, deps);
-  let journal = readJournal(args.stateDir) ?? inspected.journal;
+  let journal = retainedJournal ?? inspected.journal;
+  rejectPodmanMigration(args, effects, journal?.record);
   if (journal.phase === 'complete') {
     const retained = effects.readJson(join(args.stateDir, 'installation.json'));
     inspected.cliPlan.installerPath = await prepareCli(retained, effects);