@studiometa/trafic-agent 0.1.0

package/dist/index-C7OaqqbZ.js

@@ -0,0 +1,865 @@
+import { o as loadProjectList, f as getIdleProjects, n as loadProjectConfig, v as shouldNeverStop, h as getIdleTimeoutMs, k as getProjectInfo, u as setProjectStatus, y as stopProject } from "./server-CHT47EXr.js";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { parse } from "smol-toml";
+import { execSync } from "node:child_process";
+const DEFAULT_CONFIG_PATHS = [
+  "/etc/trafic/config.toml",
+  "./config.toml",
+  "./trafic.toml"
+];
+const DEFAULT_CONFIG = {
+  tld: "",
+  port: 9876,
+  dbPath: "/var/lib/trafic/db.sqlite",
+  projectListPath: "/home/ddev/.ddev/project_list.yaml",
+  projectsDir: "/home/ddev/www",
+  idleTimeout: "30m",
+  idleCheckInterval: "5m",
+  auth: {
+    defaultPolicy: "basic",
+    allowedIps: [],
+    tokens: [],
+    basicAuth: [],
+    rules: []
+  }
+};
+function parseDuration(duration) {
+  const regex = /(?:(\d+)h)?(?:(\d+)m)?(?:(\d+)s)?/;
+  const match = duration.match(regex);
+  if (!match) return 0;
+  const hours = parseInt(match[1] ?? "0", 10);
+  const minutes = parseInt(match[2] ?? "0", 10);
+  const seconds = parseInt(match[3] ?? "0", 10);
+  return (hours * 3600 + minutes * 60 + seconds) * 1e3;
+}
+function loadConfig(configPath) {
+  let path = configPath;
+  if (!path) {
+    path = DEFAULT_CONFIG_PATHS.find((p) => existsSync(p));
+  }
+  if (!path || !existsSync(path)) {
+    console.warn("No config file found, using defaults");
+    return DEFAULT_CONFIG;
+  }
+  const content = readFileSync(path, "utf-8");
+  const parsed = parse(content);
+  const auth = mergeAuthConfig(parsed.auth);
+  return {
+    tld: parsed.tld ?? DEFAULT_CONFIG.tld,
+    port: parsed.port ?? DEFAULT_CONFIG.port,
+    dbPath: parsed.db_path ?? DEFAULT_CONFIG.dbPath,
+    projectListPath: parsed.project_list_path ?? DEFAULT_CONFIG.projectListPath,
+    projectsDir: parsed.projects_dir ?? DEFAULT_CONFIG.projectsDir,
+    idleTimeout: parsed.idle_timeout ?? DEFAULT_CONFIG.idleTimeout,
+    idleCheckInterval: parsed.idle_check_interval ?? DEFAULT_CONFIG.idleCheckInterval,
+    auth
+  };
+}
+function mergeAuthConfig(raw) {
+  if (!raw) return DEFAULT_CONFIG.auth;
+  const rules = raw.rules ?? [];
+  return {
+    defaultPolicy: raw.default_policy ?? DEFAULT_CONFIG.auth.defaultPolicy,
+    allowedIps: raw.allowed_ips ?? DEFAULT_CONFIG.auth.allowedIps,
+    tokens: raw.tokens ?? DEFAULT_CONFIG.auth.tokens,
+    basicAuth: raw.basic_auth ?? DEFAULT_CONFIG.auth.basicAuth,
+    rules: rules.map(
+      (r) => ({
+        match: r.match,
+        policy: r.policy,
+        tokens: r.tokens,
+        allowedIps: r.allowed_ips
+      })
+    )
+  };
+}
+function validateConfig(config) {
+  const errors = [];
+  if (!config.tld) {
+    errors.push("tld is required");
+  }
+  if (config.port < 1 || config.port > 65535) {
+    errors.push("port must be between 1 and 65535");
+  }
+  if (config.auth.defaultPolicy !== "allow" && config.auth.defaultPolicy !== "deny" && config.auth.defaultPolicy !== "basic" && config.auth.defaultPolicy !== "token") {
+    errors.push('auth.default_policy must be "allow", "deny", "basic", or "token"');
+  }
+  return errors;
+}
+function stopIdleProjects(config) {
+  const globalThresholdMs = parseDuration(config.idleTimeout);
+  const projects = loadProjectList(config.projectListPath);
+  const idleProjects = getIdleProjects(globalThresholdMs);
+  for (const project of idleProjects) {
+    const projectDir = projects.get(project.name);
+    if (projectDir) {
+      const projectConfig = loadProjectConfig(projectDir);
+      if (shouldNeverStop(projectConfig)) {
+        continue;
+      }
+      const projectThresholdMs = getIdleTimeoutMs(projectConfig);
+      if (projectThresholdMs !== void 0) {
+        const idleDuration = Date.now() - project.lastAccess;
+        if (idleDuration < projectThresholdMs) {
+          continue;
+        }
+      }
+    }
+    const info2 = getProjectInfo(project.name);
+    if (info2?.status !== "running") {
+      setProjectStatus(project.name, "stopped");
+      continue;
+    }
+    console.log(`Stopping idle project: ${project.name}`);
+    const success2 = stopProject(project.name);
+    if (success2) {
+      setProjectStatus(project.name, "stopped");
+      console.log(`Stopped: ${project.name}`);
+    } else {
+      console.error(`Failed to stop: ${project.name}`);
+    }
+  }
+}
+function startIdleScheduler(config) {
+  const intervalMs = parseDuration(config.idleCheckInterval);
+  console.log(
+    `Idle scheduler started: checking every ${config.idleCheckInterval}, timeout ${config.idleTimeout}`
+  );
+  stopIdleProjects(config);
+  return setInterval(() => {
+    stopIdleProjects(config);
+  }, intervalMs);
+}
+let stepNumber = 0;
+let dryRun = false;
+function setDryRun(value) {
+  dryRun = value;
+}
+function resetSteps() {
+  stepNumber = 0;
+}
+function step(message) {
+  stepNumber++;
+  console.log(`
+\x1B[36m[${stepNumber}]\x1B[0m ${message}`);
+}
+function success(message) {
+  console.log(`    \x1B[32m✓\x1B[0m ${message}`);
+}
+function warn(message) {
+  console.log(`    \x1B[33m⚠\x1B[0m ${message}`);
+}
+function error(message) {
+  console.log(`    \x1B[31m✗\x1B[0m ${message}`);
+}
+function info(message) {
+  console.log(`    ${message}`);
+}
+function exec(command, options) {
+  if (dryRun) {
+    if (!options?.silent) {
+      console.log(`    \x1B[90m$ ${command}\x1B[0m`);
+    }
+    return "";
+  }
+  try {
+    return execSync(command, {
+      encoding: "utf-8",
+      stdio: options?.silent ? "pipe" : "inherit"
+    });
+  } catch (err) {
+    const e = err;
+    throw new Error(`Command failed: ${command}
+${e.stderr ?? ""}`);
+  }
+}
+function execSilent$1(command) {
+  if (dryRun) {
+    return "";
+  }
+  try {
+    return execSync(command, {
+      encoding: "utf-8",
+      stdio: "pipe"
+    }).trim();
+  } catch {
+    return "";
+  }
+}
+function commandExists(command) {
+  try {
+    execSync(`which ${command}`, { stdio: "pipe" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isRoot() {
+  return process.getuid?.() === 0;
+}
+function createDdevUser() {
+  step("Create ddev user");
+  const userExists = execSilent$1("id -u ddev 2>/dev/null");
+  if (userExists) {
+    info("User 'ddev' already exists");
+  } else {
+    exec("useradd -m -s /bin/bash ddev");
+    success("Created user 'ddev'");
+  }
+  exec("usermod -aG docker ddev 2>/dev/null || true", { silent: true });
+  exec("mkdir -p /home/ddev/www");
+  exec("chown ddev:ddev /home/ddev/www");
+  exec("chmod 750 /home/ddev/www");
+  success("Created /home/ddev/www");
+  exec("mkdir -p /home/ddev/.ssh");
+  exec("chmod 700 /home/ddev/.ssh");
+  exec("chown ddev:ddev /home/ddev/.ssh");
+  success("User ddev configured (no sudo needed with proper DNS)");
+}
+function installDocker() {
+  step("Install Docker");
+  if (commandExists("docker")) {
+    const version = exec("docker --version", { silent: true });
+    info(`Docker already installed: ${version?.trim() ?? "unknown version"}`);
+    return;
+  }
+  info("Downloading Docker install script...");
+  exec("curl -fsSL https://get.docker.com -o /tmp/get-docker.sh");
+  exec("sh /tmp/get-docker.sh");
+  exec("rm /tmp/get-docker.sh");
+  exec("systemctl enable docker");
+  exec("systemctl start docker");
+  success("Docker installed and started");
+  exec("usermod -aG docker ddev");
+  success("Added ddev user to docker group");
+}
+function configureDocker() {
+  step("Configure Docker");
+  const daemonConfig = {
+    "log-driver": "json-file",
+    "log-opts": {
+      "max-size": "10m",
+      "max-file": "3"
+    },
+    "storage-driver": "overlay2",
+    "live-restore": true
+  };
+  exec("mkdir -p /etc/docker");
+  const configPath = "/etc/docker/daemon.json";
+  const { writeFileSync: writeFileSync2, existsSync: existsSync2, readFileSync: readFileSync2 } = require("node:fs");
+  if (existsSync2(configPath)) {
+    try {
+      const existing = JSON.parse(readFileSync2(configPath, "utf-8"));
+      const merged = { ...existing, ...daemonConfig };
+      writeFileSync2(configPath, JSON.stringify(merged, null, 2));
+      info("Merged with existing Docker config");
+    } catch {
+      warn("Could not parse existing Docker config, skipping");
+      return;
+    }
+  } else {
+    writeFileSync2(configPath, JSON.stringify(daemonConfig, null, 2));
+  }
+  exec("systemctl reload docker || systemctl restart docker");
+  success("Docker configured with production settings");
+}
+function setupDockerPrune() {
+  step("Setup Docker cleanup cron");
+  const cronContent = `# Trafic: Clean up Docker resources weekly
+0 3 * * 0 root docker system prune -af --volumes 2>&1 | logger -t docker-prune
+`;
+  const { writeFileSync: writeFileSync2 } = require("node:fs");
+  writeFileSync2("/etc/cron.d/trafic-docker-prune", cronContent);
+  exec("chmod 644 /etc/cron.d/trafic-docker-prune");
+  success("Docker prune scheduled weekly at 3am on Sundays");
+}
+function installDdev() {
+  step("Install DDEV");
+  if (commandExists("ddev")) {
+    const version = exec("ddev --version 2>/dev/null | head -1", { silent: true });
+    info(`DDEV already installed: ${version?.trim() ?? "unknown version"}`);
+    return;
+  }
+  info("Installing DDEV...");
+  exec(
+    "curl -fsSL https://ddev.com/install.sh | bash -s -- --version latest"
+  );
+  success("DDEV installed");
+}
+function configureDdev(tld, email) {
+  step("Configure DDEV");
+  const ddevCmd = (cmd) => `su - ddev -c '${cmd}'`;
+  exec(
+    ddevCmd(
+      `ddev config global --project-tld=${tld} --router-http-port=80 --router-https-port=443 --use-letsencrypt=${email ? "true" : "false"} ${email ? `--letsencrypt-email=${email}` : ""}`
+    )
+  );
+  success(`DDEV configured with TLD: ${tld}`);
+  info(`Ensure DNS is configured: *.${tld} → server IP`);
+  if (email) {
+    success(`Let's Encrypt enabled with email: ${email}`);
+  }
+  exec(ddevCmd("ddev config global --instrumentation-opt-in=false"));
+  exec(ddevCmd("ddev poweroff || true"));
+  exec(ddevCmd("ddev start"));
+  success("DDEV router started");
+}
+function configureTraefik() {
+  step("Configure Traefik for forward auth");
+  exec("mkdir -p /home/ddev/.ddev/traefik");
+  exec("chown -R ddev:ddev /home/ddev/.ddev");
+  const staticConfig = `# Trafic: Forward auth middleware
+http:
+  middlewares:
+    trafic-auth:
+      forwardAuth:
+        address: "http://host.docker.internal:9876/__auth__"
+        authResponseHeaders:
+          - "X-Trafic-Project"
+
+    trafic-errors:
+      errors:
+        status:
+          - "502"
+          - "503"
+        service: trafic-service
+        query: "/"
+
+  services:
+    trafic-service:
+      loadBalancer:
+        servers:
+          - url: "http://host.docker.internal:9876"
+`;
+  const { writeFileSync: writeFileSync2 } = require("node:fs");
+  writeFileSync2("/home/ddev/.ddev/traefik/trafic.yaml", staticConfig);
+  exec("chown ddev:ddev /home/ddev/.ddev/traefik/trafic.yaml");
+  const routerConfig = `# Trafic: Default router configuration
+# This file makes all DDEV projects use the Trafic auth middleware
+http:
+  routers:
+    trafic-catch-all:
+      rule: "HostRegexp(\`.+\`)"
+      priority: 1
+      middlewares:
+        - trafic-auth
+        - trafic-errors
+      service: api@internal
+`;
+  writeFileSync2("/home/ddev/.ddev/traefik/dynamic.yaml", routerConfig);
+  exec("chown ddev:ddev /home/ddev/.ddev/traefik/dynamic.yaml");
+  success("Traefik configured with Trafic middleware");
+}
+function installNode() {
+  step("Install Node.js");
+  if (commandExists("node")) {
+    const version = exec("node --version", { silent: true });
+    info(`Node.js already installed: ${version?.trim()}`);
+    return;
+  }
+  exec(
+    'curl -fsSL https://fnm.vercel.app/install | bash -s -- --install-dir "/opt/fnm" --skip-shell'
+  );
+  const profileContent = `# Trafic: fnm (Node.js version manager)
+export FNM_DIR="/opt/fnm"
+export PATH="/opt/fnm:$PATH"
+eval "$(fnm env)"
+`;
+  writeFileSync("/etc/profile.d/fnm.sh", profileContent);
+  exec("chmod 644 /etc/profile.d/fnm.sh");
+  exec("export FNM_DIR=/opt/fnm && /opt/fnm/fnm install 24");
+  exec("export FNM_DIR=/opt/fnm && /opt/fnm/fnm default 24");
+  exec(
+    "ln -sf /opt/fnm/aliases/default/bin/node /usr/local/bin/node || true"
+  );
+  exec("ln -sf /opt/fnm/aliases/default/bin/npm /usr/local/bin/npm || true");
+  exec("ln -sf /opt/fnm/aliases/default/bin/npx /usr/local/bin/npx || true");
+  success("Node.js 24 installed via fnm");
+}
+function installAgent() {
+  step("Install Trafic agent");
+  exec("npm install -g @studiometa/trafic-agent");
+  success("Trafic agent installed");
+}
+function createAgentConfig(tld, _email) {
+  step("Create agent configuration");
+  const config = `# Trafic agent configuration
+# Generated by trafic setup
+
+# Required: TLD for DDEV projects
+tld = "${tld}"
+
+# Agent HTTP server port
+port = 9876
+
+# Database and paths
+db_path = "/var/lib/trafic/db.sqlite"
+project_list_path = "/home/ddev/.ddev/project_list.yaml"
+projects_dir = "/home/ddev/www"
+
+# Scale-to-zero settings
+idle_timeout = "4h"
+idle_check_interval = "5m"
+
+# Authentication
+[auth]
+default_policy = "basic"
+allowed_ips = []
+tokens = []
+basic_auth = []
+rules = []
+`;
+  writeFileSync("/etc/trafic/config.toml", config);
+  exec("chmod 640 /etc/trafic/config.toml");
+  exec("chown root:ddev /etc/trafic/config.toml");
+  success("Configuration created at /etc/trafic/config.toml");
+  info("Edit this file to configure authentication");
+}
+function createSystemdService() {
+  step("Create systemd service");
+  const serviceContent = `[Unit]
+Description=Trafic Agent - DDEV preview environment manager
+After=network.target docker.service
+Requires=docker.service
+
+[Service]
+Type=simple
+User=ddev
+Group=ddev
+ExecStart=/usr/local/bin/npx trafic-agent start --config /etc/trafic/config.toml
+Restart=always
+RestartSec=5
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=trafic-agent
+
+# Environment
+Environment=NODE_ENV=production
+
+# Security hardening
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=read-only
+ReadWritePaths=/var/lib/trafic /home/ddev/.ddev
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target
+`;
+  writeFileSync("/etc/systemd/system/trafic-agent.service", serviceContent);
+  exec("chmod 644 /etc/systemd/system/trafic-agent.service");
+  exec("systemctl daemon-reload");
+  exec("systemctl enable trafic-agent");
+  exec("systemctl start trafic-agent");
+  success("Trafic agent service started");
+  info("View logs: journalctl -u trafic-agent -f");
+}
+function hardenSsh(allowedUsers = ["ddev"]) {
+  step("Harden SSH configuration");
+  const sshConfig = `# Trafic SSH hardening
+# Generated by trafic setup
+
+# Disable root login
+PermitRootLogin no
+
+# Disable password authentication (keys only)
+PasswordAuthentication no
+PubkeyAuthentication yes
+
+# Limit authentication attempts
+MaxAuthTries 3
+
+# Idle timeout (5 minutes)
+ClientAliveInterval 300
+ClientAliveCountMax 2
+
+# Allowed users
+AllowUsers ${allowedUsers.join(" ")}
+
+# Disable X11 forwarding
+X11Forwarding no
+
+# Disable TCP forwarding
+AllowTcpForwarding no
+
+# Use strong algorithms only
+KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com
+MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
+`;
+  writeFileSync("/etc/ssh/sshd_config.d/trafic.conf", sshConfig);
+  exec("chmod 644 /etc/ssh/sshd_config.d/trafic.conf");
+  const testResult = exec("sshd -t 2>&1 || echo 'error'", { silent: true });
+  if (testResult?.includes("error")) {
+    warn("SSH config test failed, reverting...");
+    exec("rm /etc/ssh/sshd_config.d/trafic.conf");
+    return;
+  }
+  exec("systemctl reload sshd || systemctl reload ssh");
+  success("SSH hardened: root login disabled, password auth disabled");
+  info(`Allowed users: ${allowedUsers.join(", ")}`);
+}
+function configureFirewall() {
+  step("Configure firewall (UFW)");
+  if (!commandExists("ufw")) {
+    exec("apt-get update && apt-get install -y ufw", { silent: true });
+  }
+  exec("ufw --force reset", { silent: true });
+  exec("ufw default deny incoming");
+  exec("ufw default allow outgoing");
+  exec("ufw allow 22/tcp comment 'SSH'");
+  exec("ufw allow 80/tcp comment 'HTTP'");
+  exec("ufw allow 443/tcp comment 'HTTPS'");
+  exec("ufw --force enable");
+  success("Firewall enabled: SSH (22), HTTP (80), HTTPS (443) allowed");
+}
+function configureUnattendedUpgrades() {
+  step("Configure automatic security updates");
+  exec(
+    "DEBIAN_FRONTEND=noninteractive apt-get install -y unattended-upgrades apt-listchanges",
+    { silent: true }
+  );
+  const upgradesConfig = `// Trafic: Automatic security updates
+Unattended-Upgrade::Allowed-Origins {
+    "\${distro_id}:\${distro_codename}";
+    "\${distro_id}:\${distro_codename}-security";
+    "\${distro_id}ESMApps:\${distro_codename}-apps-security";
+    "\${distro_id}ESM:\${distro_codename}-infra-security";
+};
+
+// Do not automatically reboot
+Unattended-Upgrade::Automatic-Reboot "false";
+
+// Remove unused dependencies
+Unattended-Upgrade::Remove-Unused-Dependencies "true";
+
+// Email notifications (optional)
+// Unattended-Upgrade::Mail "root";
+`;
+  writeFileSync(
+    "/etc/apt/apt.conf.d/50unattended-upgrades",
+    upgradesConfig
+  );
+  const autoConfig = `APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Download-Upgradeable-Packages "1";
+APT::Periodic::AutocleanInterval "7";
+APT::Periodic::Unattended-Upgrade "1";
+`;
+  writeFileSync("/etc/apt/apt.conf.d/20auto-upgrades", autoConfig);
+  exec("systemctl enable unattended-upgrades");
+  exec("systemctl start unattended-upgrades");
+  success("Automatic security updates enabled");
+}
+function configureFail2ban() {
+  step("Configure Fail2ban");
+  if (!commandExists("fail2ban-client")) {
+    exec("apt-get update && apt-get install -y fail2ban", { silent: true });
+  }
+  const jailConfig = `# Trafic: Fail2ban configuration
+[DEFAULT]
+bantime = 3600
+findtime = 600
+maxretry = 5
+backend = auto
+
+[sshd]
+enabled = true
+port = ssh
+filter = sshd
+logpath = /var/log/auth.log
+maxretry = 3
+bantime = 7200
+`;
+  writeFileSync("/etc/fail2ban/jail.local", jailConfig);
+  exec("chmod 644 /etc/fail2ban/jail.local");
+  exec("systemctl enable fail2ban");
+  exec("systemctl restart fail2ban");
+  success("Fail2ban enabled: SSH brute force protection active");
+}
+function configureSystemLimits() {
+  step("Configure system limits");
+  const limitsConfig = `# Trafic: System limits for ddev user
+ddev soft nofile 65536
+ddev hard nofile 65536
+ddev soft nproc 4096
+ddev hard nproc 4096
+`;
+  writeFileSync("/etc/security/limits.d/trafic.conf", limitsConfig);
+  exec("chmod 644 /etc/security/limits.d/trafic.conf");
+  success("System limits configured for ddev user");
+}
+function configureFilePermissions() {
+  step("Configure file permissions");
+  exec("mkdir -p /etc/trafic");
+  exec("mkdir -p /var/lib/trafic");
+  exec("mkdir -p /var/backups/trafic");
+  exec("chmod 755 /etc/trafic");
+  exec("chmod 700 /var/lib/trafic");
+  exec("chmod 700 /var/backups/trafic");
+  exec("chown root:ddev /etc/trafic");
+  exec("chown ddev:ddev /var/lib/trafic");
+  exec("chown ddev:ddev /var/backups/trafic");
+  if (existsSync("/etc/trafic/config.toml")) {
+    exec("chmod 640 /etc/trafic/config.toml");
+    exec("chown root:ddev /etc/trafic/config.toml");
+  }
+  success("File permissions configured");
+}
+function hardenServer(sshUsers = ["ddev"]) {
+  hardenSsh(sshUsers);
+  configureFirewall();
+  configureUnattendedUpgrades();
+  configureFail2ban();
+  configureSystemLimits();
+  configureFilePermissions();
+}
+function execSilent(command) {
+  try {
+    return execSync(command, { encoding: "utf-8", stdio: "pipe" }).trim();
+  } catch {
+    return "";
+  }
+}
+function isServiceActive(service) {
+  const status = execSilent(`systemctl is-active ${service}`);
+  return status === "active";
+}
+function auditSsh() {
+  const checks = [];
+  const sshdConfig = existsSync("/etc/ssh/sshd_config") ? readFileSync("/etc/ssh/sshd_config", "utf-8") : "";
+  const traficConfig = existsSync("/etc/ssh/sshd_config.d/trafic.conf") ? readFileSync("/etc/ssh/sshd_config.d/trafic.conf", "utf-8") : "";
+  const config = sshdConfig + "\n" + traficConfig;
+  const rootLoginDisabled = config.includes("PermitRootLogin no") || config.includes("PermitRootLogin prohibit-password");
+  checks.push({
+    name: "SSH root login",
+    status: rootLoginDisabled ? "pass" : "fail",
+    message: rootLoginDisabled ? "Root login disabled" : "Root login may be enabled",
+    fix: "Add 'PermitRootLogin no' to /etc/ssh/sshd_config.d/trafic.conf"
+  });
+  const passwordAuthDisabled = config.includes("PasswordAuthentication no");
+  checks.push({
+    name: "SSH password auth",
+    status: passwordAuthDisabled ? "pass" : "warn",
+    message: passwordAuthDisabled ? "Password authentication disabled" : "Password authentication may be enabled",
+    fix: "Add 'PasswordAuthentication no' to /etc/ssh/sshd_config.d/trafic.conf"
+  });
+  return checks;
+}
+function auditFirewall() {
+  const checks = [];
+  const ufwStatus = execSilent("ufw status");
+  const isActive = ufwStatus.includes("Status: active");
+  checks.push({
+    name: "Firewall (UFW)",
+    status: isActive ? "pass" : "fail",
+    message: isActive ? "UFW is active" : "UFW is not active",
+    fix: "Run: ufw enable"
+  });
+  if (isActive) {
+    const allows22 = ufwStatus.includes("22/tcp");
+    const allows80 = ufwStatus.includes("80/tcp");
+    const allows443 = ufwStatus.includes("443/tcp");
+    if (allows22 && allows80 && allows443) {
+      checks.push({
+        name: "Firewall ports",
+        status: "pass",
+        message: "Required ports (22, 80, 443) are open"
+      });
+    } else {
+      checks.push({
+        name: "Firewall ports",
+        status: "warn",
+        message: "Some required ports may be blocked",
+        fix: "Run: ufw allow 22/tcp && ufw allow 80/tcp && ufw allow 443/tcp"
+      });
+    }
+  }
+  return checks;
+}
+function auditServices() {
+  const checks = [];
+  const fail2banActive = isServiceActive("fail2ban");
+  checks.push({
+    name: "Fail2ban",
+    status: fail2banActive ? "pass" : "warn",
+    message: fail2banActive ? "Fail2ban is active" : "Fail2ban is not running",
+    fix: "Run: apt install fail2ban && systemctl enable fail2ban --now"
+  });
+  const unattendedActive = isServiceActive("unattended-upgrades");
+  checks.push({
+    name: "Automatic updates",
+    status: unattendedActive ? "pass" : "warn",
+    message: unattendedActive ? "Unattended upgrades enabled" : "Automatic updates not configured",
+    fix: "Run: apt install unattended-upgrades && dpkg-reconfigure unattended-upgrades"
+  });
+  const agentActive = isServiceActive("trafic-agent");
+  checks.push({
+    name: "Trafic agent",
+    status: agentActive ? "pass" : "fail",
+    message: agentActive ? "Trafic agent is running" : "Trafic agent is not running",
+    fix: "Run: systemctl start trafic-agent"
+  });
+  return checks;
+}
+function auditDocker() {
+  const checks = [];
+  const dockerActive = isServiceActive("docker");
+  checks.push({
+    name: "Docker",
+    status: dockerActive ? "pass" : "fail",
+    message: dockerActive ? "Docker is running" : "Docker is not running",
+    fix: "Run: systemctl start docker"
+  });
+  const danglingImages = execSilent(
+    "docker images -f dangling=true -q | wc -l"
+  );
+  const count = parseInt(danglingImages, 10) || 0;
+  if (count > 0) {
+    checks.push({
+      name: "Docker cleanup",
+      status: "warn",
+      message: `${count} dangling Docker images`,
+      fix: "Run: docker system prune -f"
+    });
+  }
+  const diskUsage = execSilent("df -h / | awk 'NR==2{print $5}'");
+  const usagePercent = parseInt(diskUsage, 10) || 0;
+  checks.push({
+    name: "Disk usage",
+    status: usagePercent > 90 ? "fail" : usagePercent > 80 ? "warn" : "pass",
+    message: `Disk usage: ${diskUsage}`,
+    fix: usagePercent > 80 ? "Consider cleaning up old projects or Docker resources" : void 0
+  });
+  return checks;
+}
+function auditPermissions() {
+  const checks = [];
+  if (existsSync("/etc/trafic/config.toml")) {
+    const stats = execSilent("stat -c '%a' /etc/trafic/config.toml");
+    const isSecure = stats === "640" || stats === "600";
+    checks.push({
+      name: "Config permissions",
+      status: isSecure ? "pass" : "warn",
+      message: isSecure ? "Config file has secure permissions" : `Config file permissions: ${stats} (should be 640)`,
+      fix: "Run: chmod 640 /etc/trafic/config.toml"
+    });
+  }
+  if (existsSync("/home/ddev/www")) {
+    const owner = execSilent("stat -c '%U:%G' /home/ddev/www");
+    const isCorrect = owner === "ddev:ddev";
+    checks.push({
+      name: "Projects directory",
+      status: isCorrect ? "pass" : "warn",
+      message: isCorrect ? "Projects directory owned by ddev" : `Projects directory owner: ${owner}`,
+      fix: "Run: chown ddev:ddev /home/ddev/www"
+    });
+  }
+  return checks;
+}
+function runAudit() {
+  return [
+    ...auditSsh(),
+    ...auditFirewall(),
+    ...auditServices(),
+    ...auditDocker(),
+    ...auditPermissions()
+  ];
+}
+function printAuditResults(checks) {
+  console.log("\n\x1B[1mSecurity Audit Results\x1B[0m\n");
+  for (const check of checks) {
+    const icon = check.status === "pass" ? "\x1B[32m✓\x1B[0m" : check.status === "warn" ? "\x1B[33m⚠\x1B[0m" : "\x1B[31m✗\x1B[0m";
+    console.log(`${icon} \x1B[1m${check.name}\x1B[0m: ${check.message}`);
+    if (check.fix && check.status !== "pass") {
+      console.log(`  \x1B[90m${check.fix}\x1B[0m`);
+    }
+  }
+  const passed = checks.filter((c) => c.status === "pass").length;
+  const warnings = checks.filter((c) => c.status === "warn").length;
+  const failed = checks.filter((c) => c.status === "fail").length;
+  console.log(
+    `
+\x1B[1mSummary:\x1B[0m ${passed} passed, ${warnings} warnings, ${failed} failed`
+  );
+}
+async function setup(options) {
+  resetSteps();
+  setDryRun(options.dryRun ?? false);
+  console.log("\n\x1B[1m🚦 Trafic Server Setup\x1B[0m\n");
+  if (options.dryRun) {
+    console.log("\x1B[33m⚠ Dry-run mode: no changes will be made\x1B[0m\n");
+  }
+  if (!isRoot() && !options.dryRun) {
+    error("This command must be run as root");
+    console.log("  Run: sudo trafic-agent setup ...");
+    process.exit(1);
+  }
+  info(`TLD: ${options.tld}`);
+  if (options.email) {
+    info(`Let's Encrypt email: ${options.email}`);
+  }
+  if (options.noHardening) {
+    info("Hardening: disabled");
+  }
+  try {
+    createDdevUser();
+    if (!options.noDocker) {
+      installDocker();
+      configureDocker();
+      setupDockerPrune();
+    } else {
+      step("Install Docker");
+      info("Skipped (--no-docker)");
+    }
+    if (!options.noDdev) {
+      installDdev();
+      configureDdev(options.tld, options.email);
+      configureTraefik();
+    } else {
+      step("Install DDEV");
+      info("Skipped (--no-ddev)");
+    }
+    installNode();
+    installAgent();
+    createAgentConfig(options.tld, options.email);
+    createSystemdService();
+    if (!options.noHardening) {
+      const sshUsers = options.sshUsers ?? ["ddev"];
+      hardenServer(sshUsers);
+    } else {
+      step("Server hardening");
+      info("Skipped (--no-hardening)");
+    }
+    console.log("\n\x1B[32m✓ Setup complete!\x1B[0m\n");
+    console.log("Next steps:");
+    console.log(`  1. Edit /etc/trafic/config.toml to configure authentication`);
+    console.log(`  2. Add SSH public keys to /home/ddev/.ssh/authorized_keys`);
+    console.log(`  3. Deploy your first project:`);
+    console.log(`     npx @studiometa/trafic-cli deploy --host=<this-server> --name=my-app`);
+    console.log(`
+Your projects will be available at https://<name>.${options.tld}`);
+  } catch (err) {
+    error(`Setup failed: ${err instanceof Error ? err.message : err}`);
+    process.exit(1);
+  }
+}
+async function audit() {
+  const checks = runAudit();
+  printAuditResults(checks);
+  const failed = checks.filter((c) => c.status === "fail").length;
+  if (failed > 0) {
+    process.exit(1);
+  }
+}
+export {
+  audit as a,
+  printAuditResults as b,
+  startIdleScheduler as c,
+  stopIdleProjects as d,
+  loadConfig as l,
+  parseDuration as p,
+  runAudit as r,
+  setup as s,
+  validateConfig as v
+};
+//# sourceMappingURL=index-C7OaqqbZ.js.map