npm - @studiometa/trafic-agent - Versions diffs - 0.1.13 → 0.1.15 - Mend

@studiometa/trafic-agent 0.1.13 → 0.1.15

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (13) hide show

package/README.md +17 -11
package/dist/cli.js +88 -9
package/dist/cli.js.map +1 -1
package/dist/index.js +1 -1
package/dist/setup/migrations/0003__ddev_router_bind_all_interfaces.d.ts +15 -0
package/dist/setup/migrations/0003__ddev_router_bind_all_interfaces.d.ts.map +1 -0
package/dist/setup/migrations/index.d.ts.map +1 -1
package/dist/setup/upgrade.d.ts +27 -0
package/dist/setup/upgrade.d.ts.map +1 -0
package/dist/{setup-DGwXLdk_.js → setup-_IJ40DuS.js} +28 -4
package/dist/setup-_IJ40DuS.js.map +1 -0
package/package.json +1 -1
package/dist/setup-DGwXLdk_.js.map +0 -1

package/README.md CHANGED Viewed

@@ -42,31 +42,37 @@ trafic-agent setup --tld previews.example.com
 - Root access (for initial setup)
 - Wildcard DNS pointing to the server
-### `trafic-agent upgrade`
+### `trafic-agent upgrade` / `trafic-agent update`
-Run pending server migrations to bring an existing server up-to-date after a `trafic-agent` update. Migrations are forward-only and idempotent — safe to run multiple times.
+Upgrade the server to the latest version of `trafic-agent` in one command. `update` is an alias for `upgrade`.
-Fresh servers set up with `trafic-agent setup` have all migrations automatically marked as applied, so `upgrade` is only relevant for existing deployments.
+Steps:
+1. **Check for updates** — queries the npm registry for the latest version
+2. **Install** — runs `npm install -g @studiometa/trafic-agent@latest` if a newer version is available
+3. **Migrations** — runs any pending server migrations (forward-only, idempotent)
+4. **Restart** — restarts the `trafic-agent` systemd service
-```bash
-# Preview what would be done
-sudo trafic-agent upgrade --dry-run
+Fresh servers set up with `trafic-agent setup` have all migrations automatically marked as applied, so migrations only run when needed on existing deployments.
-# Apply all pending migrations
+```bash
+# Upgrade to the latest version (recommended)
 sudo trafic-agent upgrade
-# List all migrations and their status
+# Preview what would be done without making changes
+sudo trafic-agent upgrade --dry-run
+# List all migrations and their status (no install or restart)
 trafic-agent upgrade --list
 ```
 Example `--list` output:
 ```
-✓ 0001__ddev_apt_repo   Migrate DDEV from manual tarball to apt repository   (applied)
-→ 0002__...             ...                                                    (pending)
+✓ 0001__ddev_apt_repo     Migrate DDEV from manual tarball to apt repository   (applied)
+✓ 0002__mkcert_ddev_user  Install mkcert CA in the ddev user trust store       (applied)
 ```
-State is stored in `/etc/trafic/.migrations.json` and is updated after each individual migration, so a partial failure leaves the state consistent.
+Migration state is stored in `/etc/trafic/.migrations.json` and updated after each individual migration, so a partial failure leaves the state consistent.
 ## Configuration

package/dist/cli.js CHANGED Viewed

@@ -1,7 +1,83 @@
 #!/usr/bin/env node
-import { d as validateConfig, i as runPendingMigrations, l as loadConfig, n as setup, r as listMigrations, s as startIdleScheduler, t as audit } from "./setup-DGwXLdk_.js";
+import { _ as validateConfig, c as info, d as success, f as warn, h as loadConfig, i as runPendingMigrations, l as isRoot, n as setup, p as startIdleScheduler, r as listMigrations, s as exec, t as audit, u as step } from "./setup-_IJ40DuS.js";
 import { o as closeDb, t as startServer } from "./server-D6zlodZz.js";
+import { execSync } from "node:child_process";
 import { parseArgs } from "node:util";
+/**
+* Fetch the latest published version of @studiometa/trafic-agent from the npm registry.
+* Returns null if the registry is unreachable.
+*/
+function fetchLatestVersion() {
+	try {
+		return execSync("npm show @studiometa/trafic-agent version", {
+			encoding: "utf-8",
+			stdio: "pipe"
+		}).trim();
+	} catch {
+		return null;
+	}
+}
+/**
+* Compare two semver strings. Returns true if `next` is strictly greater than `current`.
+* Handles simple MAJOR.MINOR.PATCH without pre-release suffixes.
+*/
+function isNewer(current, next) {
+	const parse = (v) => {
+		const parts = v.replace(/^v/, "").split(".").map(Number);
+		return [
+			parts[0] ?? 0,
+			parts[1] ?? 0,
+			parts[2] ?? 0
+		];
+	};
+	const [cMaj, cMin, cPat] = parse(current);
+	const [nMaj, nMin, nPat] = parse(next);
+	if (nMaj !== cMaj) return nMaj > cMaj;
+	if (nMin !== cMin) return nMin > cMin;
+	return nPat > cPat;
+}
+/**
+* Install the latest version of @studiometa/trafic-agent globally via npm.
+*/
+function installLatestAgent(dryRun) {
+	exec("npm install -g @studiometa/trafic-agent@latest", { silent: !dryRun });
+}
+/**
+* Restart the trafic-agent systemd service.
+*/
+function restartAgentService(dryRun) {
+	exec("systemctl restart trafic-agent", { silent: !dryRun });
+}
+/**
+* Full upgrade sequence:
+*  1. Check for a new version on npm
+*  2. Install it globally if one is found
+*  3. Run pending migrations
+*  4. Restart the systemd service
+*/
+function runUpgrade(dryRun = false) {
+	if (!isRoot() && !dryRun) {
+		console.error("    \x1B[31m✗\x1B[0m This command must be run as root");
+		console.log("  Run: sudo trafic-agent upgrade");
+		process.exit(1);
+	}
+	step("Check for updates");
+	const current = "0.1.15";
+	info(`Current version: ${current}`);
+	const latest = fetchLatestVersion();
+	if (!latest) warn("Could not reach npm registry — skipping version check");
+	else if (isNewer(current, latest)) {
+		success(`New version available: ${latest}`);
+		step("Install latest version");
+		installLatestAgent(dryRun);
+		if (!dryRun) success(`Installed @studiometa/trafic-agent@${latest}`);
+	} else success(`Already up to date (${current})`);
+	step("Run pending migrations");
+	runPendingMigrations(dryRun);
+	step("Restart trafic-agent service");
+	restartAgentService(dryRun);
+	if (!dryRun) success("Service restarted");
+}
 var HELP = `
 trafic-agent — Server agent for DDEV preview environments
@@ -11,7 +87,8 @@ Usage:
 Commands:
   start                   Start the agent server
   setup                   Setup a new server (Docker, DDEV, hardening)
-  upgrade                 Run pending server migrations
+  upgrade                 Check for a new version, install it, run migrations, restart the service
+  update                  Alias for upgrade
   audit                   Run security audit checks
   version                 Show version
   help                    Show this help
@@ -29,9 +106,9 @@ Setup options:
   --ssh-users <users>     Comma-separated list of SSH users to allow (default: ddev)
   --dry-run               Show what would be done without making changes
-Upgrade options:
+Upgrade/update options:
   --dry-run               Show what would be done without making changes
-  --list                  List all migrations and their status
+  --list                  List all migrations and their status (no install or restart)
 Examples:
   # Start the agent
@@ -43,10 +120,11 @@ Examples:
   sudo trafic-agent setup --tld=previews.example.com --email=admin@example.com
   sudo trafic-agent setup --tld=previews.example.com --no-hardening --dry-run
-  # Run pending server migrations
+  # Upgrade: install latest version, run migrations, restart service
   sudo trafic-agent upgrade
   sudo trafic-agent upgrade --dry-run
   trafic-agent upgrade --list
+  sudo trafic-agent update          # alias for upgrade
   # Run security audit
   trafic-agent audit
@@ -55,7 +133,7 @@ function printHelp() {
 	console.log(HELP.trim());
 }
 function printVersion() {
-	console.log("0.1.13");
+	console.log("0.1.15");
 }
 async function runStart(values) {
 	const config = loadConfig(values.config);
@@ -76,7 +154,7 @@ async function runStart(values) {
 	startServer(config);
 	startIdleScheduler(config);
 }
-function runUpgrade(values) {
+function handleUpgrade(values) {
 	const dryRun = values["dry-run"];
 	if (values.list) {
 		const entries = listMigrations();
@@ -91,7 +169,7 @@ function runUpgrade(values) {
 	}
 	console.log("\n\x1B[1m🚦 Trafic Server Upgrade\x1B[0m\n");
 	if (dryRun) console.log("\x1B[33m⚠ Dry-run mode: no changes will be made\x1B[0m\n");
-	runPendingMigrations(dryRun ?? false);
+	runUpgrade(dryRun ?? false);
 	if (!dryRun) console.log("\n\x1B[32m✓ Upgrade complete!\x1B[0m\n");
 }
 async function runSetup(values) {
@@ -157,7 +235,8 @@ async function main() {
 			await runSetup(values);
 			break;
 		case "upgrade":
-			runUpgrade(values);
+		case "update":
+			handleUpgrade(values);
 			break;
 		case "audit":
 			await audit();

package/dist/cli.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"cli.js","names":[],"sources":["../src/cli.ts"],"sourcesContent":["#!/usr/bin/env node\n\nimport { parseArgs } from \"node:util\";\nimport { loadConfig, validateConfig } from \"./utils/config.js\";\nimport { startServer } from \"./server.js\";\nimport { startIdleScheduler } from \"./tasks/stop-idle.js\";\nimport { closeDb } from \"./utils/db.js\";\nimport { setup, audit } from \"./setup/index.js\";\nimport { listMigrations, runPendingMigrations } from \"./setup/migrations/index.js\";\n\ndeclare const __VERSION__: string;\n\nconst HELP = `\ntrafic-agent — Server agent for DDEV preview environments\n\nUsage:\n trafic-agent <command> [options]\n\nCommands:\n start Start the agent server\n setup Setup a new server (Docker, DDEV, hardening)\n upgrade Run pending server migrations\n audit Run security audit checks\n version Show version\n help Show this help\n\nStart options:\n -c, --config <path> Path to config file (default: /etc/trafic/config.toml)\n -p, --port <port> Override port from config\n\nSetup options:\n --tld <domain> TLD for DDEV projects (required on first run, reused from config on re-runs)\n --email <email> Email for Let's Encrypt certificates\n --no-hardening Skip server hardening steps\n --no-docker Skip Docker installation\n --no-ddev Skip DDEV installation\n --ssh-users <users> Comma-separated list of SSH users to allow (default: ddev)\n --dry-run Show what would be done without making changes\n\nUpgrade options:\n --dry-run Show what would be done without making changes\n --list List all migrations and their status\n\nExamples:\n # Start the agent\n trafic-agent start\n trafic-agent start --config /path/to/config.toml\n\n # Setup a new server\n sudo trafic-agent setup --tld=previews.example.com\n sudo trafic-agent setup --tld=previews.example.com --email=admin@example.com\n sudo trafic-agent setup --tld=previews.example.com --no-hardening --dry-run\n\n # Run pending server migrations\n sudo trafic-agent upgrade\n sudo trafic-agent upgrade --dry-run\n trafic-agent upgrade --list\n\n # Run security audit\n trafic-agent audit\n`;\n\nfunction printHelp(): void {\n console.log(HELP.trim());\n}\n\nfunction printVersion(): void {\n console.log(__VERSION__);\n}\n\nasync function runStart(values: Record<string, unknown>): Promise<void> {\n // Load config\n const config = loadConfig(values.config as string \| undefined);\n\n // Override port if specified\n if (values.port) {\n config.port = parseInt(values.port as string, 10);\n }\n\n // Validate config\n const errors = validateConfig(config);\n if (errors.length > 0) {\n console.error(\"Configuration errors:\");\n for (const error of errors) {\n console.error(` - ${error}`);\n }\n process.exit(1);\n }\n\n // Graceful shutdown\n const shutdown = (): void => {\n console.log(\"\\nShutting down...\");\n closeDb();\n process.exit(0);\n };\n\n process.on(\"SIGINT\", shutdown);\n process.on(\"SIGTERM\", shutdown);\n\n // Start server and scheduler\n startServer(config);\n startIdleScheduler(config);\n}\n\nfunction runUpgrade(values: Record<string, unknown>): void {\n const dryRun = values[\"dry-run\"] as boolean \| undefined;\n const list = values.list as boolean \| undefined;\n\n if (list) {\n const entries = listMigrations();\n console.log(\"\\nMigrations:\\n\");\n\n for (const { migration, status } of entries) {\n const icon = status === \"applied\" ? \"\\x1b[32m✓\\x1b[0m\" : \"\\x1b[36m→\\x1b[0m\";\n const label = status === \"applied\" ? \"\\x1b[90m(applied)\\x1b[0m\" : \"(pending)\";\n console.log(` ${icon} \\x1b[1m${migration.id.padEnd(30)}\\x1b[0m ${migration.description.padEnd(55)} ${label}`);\n }\n\n console.log(\"\");\n return;\n }\n\n console.log(\"\\n\\x1b[1m🚦 Trafic Server Upgrade\\x1b[0m\\n\");\n\n if (dryRun) {\n console.log(\"\\x1b[33m⚠ Dry-run mode: no changes will be made\\x1b[0m\\n\");\n }\n\n runPendingMigrations(dryRun ?? false);\n\n if (!dryRun) {\n console.log(\"\\n\\x1b[32m✓ Upgrade complete!\\x1b[0m\\n\");\n }\n}\n\nasync function runSetup(values: Record<string, unknown>): Promise<void> {\n // Load existing config to use as defaults on re-runs\n const existingConfig = loadConfig();\n const tld = (values.tld as string \| undefined) ?? (existingConfig.tld \|\| undefined);\n\n if (!tld) {\n console.error(\"Error: --tld is required for setup\");\n console.error(\"Example: trafic-agent setup --tld=previews.example.com\");\n process.exit(1);\n }\n\n await setup({\n tld,\n email: values.email as string \| undefined,\n noHardening: values[\"no-hardening\"] as boolean \| undefined,\n noDocker: values[\"no-docker\"] as boolean \| undefined,\n noDdev: values[\"no-ddev\"] as boolean \| undefined,\n sshUsers: values[\"ssh-users\"]\n ? (values[\"ssh-users\"] as string).split(\",\").map((s) => s.trim())\n : undefined,\n dryRun: values[\"dry-run\"] as boolean \| undefined,\n });\n}\n\nasync function main(): Promise<void> {\n const { values, positionals } = parseArgs({\n allowPositionals: true,\n options: {\n // Common\n help: { type: \"boolean\", short: \"h\" },\n\n // Start options\n config: { type: \"string\", short: \"c\" },\n port: { type: \"string\", short: \"p\" },\n\n // Setup options\n tld: { type: \"string\" },\n email: { type: \"string\" },\n \"no-hardening\": { type: \"boolean\" },\n \"no-docker\": { type: \"boolean\" },\n \"no-ddev\": { type: \"boolean\" },\n \"ssh-users\": { type: \"string\" },\n \"dry-run\": { type: \"boolean\" },\n\n // Upgrade options\n list: { type: \"boolean\" },\n },\n });\n\n const command = positionals[0] ?? \"help\";\n\n if (values.help) {\n printHelp();\n process.exit(0);\n }\n\n switch (command) {\n case \"help\":\n printHelp();\n break;\n\n case \"version\":\n printVersion();\n break;\n\n case \"start\":\n await runStart(values);\n break;\n\n case \"setup\":\n await runSetup(values);\n break;\n\n case \"upgrade\":\n runUpgrade(values);\n break;\n\n case \"audit\":\n await audit();\n break;\n\n default:\n console.error(`Unknown command: ${command}`);\n printHelp();\n process.exit(1);\n }\n}\n\nmain().catch((error) => {\n console.error(\"Fatal error:\", error);\n process.exit(1);\n});\n"],"mappings":";;;;AAYA,IAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkDb,SAAS,YAAkB;AACzB,SAAQ,IAAI,KAAK,MAAM,CAAC;;AAG1B,SAAS,eAAqB;AAC5B,SAAQ,IAAA,SAAgB;;AAG1B,eAAe,SAAS,QAAgD;CAEtE,MAAM,SAAS,WAAW,OAAO,OAA6B;AAG9D,KAAI,OAAO,KACT,QAAO,OAAO,SAAS,OAAO,MAAgB,GAAG;CAInD,MAAM,SAAS,eAAe,OAAO;AACrC,KAAI,OAAO,SAAS,GAAG;AACrB,UAAQ,MAAM,wBAAwB;AACtC,OAAK,MAAM,SAAS,OAClB,SAAQ,MAAM,OAAO,QAAQ;AAE/B,UAAQ,KAAK,EAAE;;CAIjB,MAAM,iBAAuB;AAC3B,UAAQ,IAAI,qBAAqB;AACjC,WAAS;AACT,UAAQ,KAAK,EAAE;;AAGjB,SAAQ,GAAG,UAAU,SAAS;AAC9B,SAAQ,GAAG,WAAW,SAAS;AAG/B,aAAY,OAAO;AACnB,oBAAmB,OAAO;;AAG5B,SAAS,WAAW,QAAuC;CACzD,MAAM,SAAS,OAAO;AAGtB,KAFa,OAAO,MAEV;EACR,MAAM,UAAU,gBAAgB;AAChC,UAAQ,IAAI,kBAAkB;AAE9B,OAAK,MAAM,EAAE,WAAW,YAAY,SAAS;GAC3C,MAAM,OAAO,WAAW,YAAY,qBAAqB;GACzD,MAAM,QAAQ,WAAW,YAAY,6BAA6B;AAClE,WAAQ,IAAI,KAAK,KAAK,UAAU,UAAU,GAAG,OAAO,GAAG,CAAC,UAAU,UAAU,YAAY,OAAO,GAAG,CAAC,GAAG,QAAQ;;AAGhH,UAAQ,IAAI,GAAG;AACf;;AAGF,SAAQ,IAAI,6CAA6C;AAEzD,KAAI,OACF,SAAQ,IAAI,2DAA2D;AAGzE,sBAAqB,UAAU,MAAM;AAErC,KAAI,CAAC,OACH,SAAQ,IAAI,yCAAyC;;AAIzD,eAAe,SAAS,QAAgD;CAEtE,MAAM,iBAAiB,YAAY;CACnC,MAAM,MAAO,OAAO,QAA+B,eAAe,OAAO,KAAA;AAEzE,KAAI,CAAC,KAAK;AACR,UAAQ,MAAM,qCAAqC;AACnD,UAAQ,MAAM,yDAAyD;AACvE,UAAQ,KAAK,EAAE;;AAGjB,OAAM,MAAM;EACV;EACA,OAAO,OAAO;EACd,aAAa,OAAO;EACpB,UAAU,OAAO;EACjB,QAAQ,OAAO;EACf,UAAU,OAAO,eACZ,OAAO,aAAwB,MAAM,IAAI,CAAC,KAAK,MAAM,EAAE,MAAM,CAAC,GAC/D,KAAA;EACJ,QAAQ,OAAO;EAChB,CAAC;;AAGJ,eAAe,OAAsB;CACnC,MAAM,EAAE,QAAQ,gBAAgB,UAAU;EACxC,kBAAkB;EAClB,SAAS;GAEP,MAAM;IAAE,MAAM;IAAW,OAAO;IAAK;GAGrC,QAAQ;IAAE,MAAM;IAAU,OAAO;IAAK;GACtC,MAAM;IAAE,MAAM;IAAU,OAAO;IAAK;GAGpC,KAAK,EAAE,MAAM,UAAU;GACvB,OAAO,EAAE,MAAM,UAAU;GACzB,gBAAgB,EAAE,MAAM,WAAW;GACnC,aAAa,EAAE,MAAM,WAAW;GAChC,WAAW,EAAE,MAAM,WAAW;GAC9B,aAAa,EAAE,MAAM,UAAU;GAC/B,WAAW,EAAE,MAAM,WAAW;GAG9B,MAAM,EAAE,MAAM,WAAW;GAC1B;EACF,CAAC;CAEF,MAAM,UAAU,YAAY,MAAM;AAElC,KAAI,OAAO,MAAM;AACf,aAAW;AACX,UAAQ,KAAK,EAAE;;AAGjB,SAAQ,SAAR;EACE,KAAK;AACH,cAAW;AACX;EAEF,KAAK;AACH,iBAAc;AACd;EAEF,KAAK;AACH,SAAM,SAAS,OAAO;AACtB;EAEF,KAAK;AACH,SAAM,SAAS,OAAO;AACtB;EAEF,KAAK;AACH,cAAW,OAAO;AAClB;EAEF,KAAK;AACH,SAAM,OAAO;AACb;EAEF;AACE,WAAQ,MAAM,oBAAoB,UAAU;AAC5C,cAAW;AACX,WAAQ,KAAK,EAAE;;;AAIrB,MAAM,CAAC,OAAO,UAAU;AACtB,SAAQ,MAAM,gBAAgB,MAAM;AACpC,SAAQ,KAAK,EAAE;EACf"}
1	+ {"version":3,"file":"cli.js","names":[],"sources":["../src/setup/upgrade.ts","../src/cli.ts"],"sourcesContent":["import { execSync } from \"node:child_process\";\nimport { step, success, info, warn, exec, isRoot } from \"./steps.js\";\nimport { runPendingMigrations } from \"./migrations/index.js\";\n\ndeclare const __VERSION__: string;\n\n/*\n Fetch the latest published version of @studiometa/trafic-agent from the npm registry.\n * Returns null if the registry is unreachable.\n /\nexport function fetchLatestVersion(): string \| null {\n try {\n return execSync(\"npm show @studiometa/trafic-agent version\", {\n encoding: \"utf-8\",\n stdio: \"pipe\",\n }).trim();\n } catch {\n return null;\n }\n}\n\n/\n Compare two semver strings. Returns true if `next` is strictly greater than `current`.\n * Handles simple MAJOR.MINOR.PATCH without pre-release suffixes.\n /\nexport function isNewer(current: string, next: string): boolean {\n const parse = (v: string): [number, number, number] => {\n const parts = v.replace(/^v/, \"\").split(\".\").map(Number);\n return [parts[0] ?? 0, parts[1] ?? 0, parts[2] ?? 0];\n };\n\n const [cMaj, cMin, cPat] = parse(current);\n const [nMaj, nMin, nPat] = parse(next);\n\n if (nMaj !== cMaj) return nMaj > cMaj;\n if (nMin !== cMin) return nMin > cMin;\n return nPat > cPat;\n}\n\n/\n Install the latest version of @studiometa/trafic-agent globally via npm.\n /\nexport function installLatestAgent(dryRun: boolean): void {\n exec(\"npm install -g @studiometa/trafic-agent@latest\", { silent: !dryRun });\n}\n\n/\n Restart the trafic-agent systemd service.\n /\nexport function restartAgentService(dryRun: boolean): void {\n exec(\"systemctl restart trafic-agent\", { silent: !dryRun });\n}\n\n/\n Full upgrade sequence:\n * 1. Check for a new version on npm\n * 2. Install it globally if one is found\n * 3. Run pending migrations\n * 4. Restart the systemd service\n */\nexport function runUpgrade(dryRun = false): void {\n if (!isRoot() && !dryRun) {\n console.error(\" \\x1b[31m✗\\x1b[0m This command must be run as root\");\n console.log(\" Run: sudo trafic-agent upgrade\");\n process.exit(1);\n }\n\n // ── Step 1: Check for updates ─────────────────────────────────────────────\n step(\"Check for updates\");\n\n const current = __VERSION__;\n info(`Current version: ${current}`);\n\n const latest = fetchLatestVersion();\n\n if (!latest) {\n warn(\"Could not reach npm registry — skipping version check\");\n } else if (isNewer(current, latest)) {\n success(`New version available: ${latest}`);\n\n // ── Step 2: Install ───────────────────────────────────────────────────\n step(\"Install latest version\");\n installLatestAgent(dryRun);\n if (!dryRun) {\n success(`Installed @studiometa/trafic-agent@${latest}`);\n }\n } else {\n success(`Already up to date (${current})`);\n }\n\n // ── Step 3: Run pending migrations ───────────────────────────────────────\n step(\"Run pending migrations\");\n runPendingMigrations(dryRun);\n\n // ── Step 4: Restart service ───────────────────────────────────────────────\n step(\"Restart trafic-agent service\");\n restartAgentService(dryRun);\n if (!dryRun) {\n success(\"Service restarted\");\n }\n}\n","#!/usr/bin/env node\n\nimport { parseArgs } from \"node:util\";\nimport { loadConfig, validateConfig } from \"./utils/config.js\";\nimport { startServer } from \"./server.js\";\nimport { startIdleScheduler } from \"./tasks/stop-idle.js\";\nimport { closeDb } from \"./utils/db.js\";\nimport { setup, audit } from \"./setup/index.js\";\nimport { listMigrations } from \"./setup/migrations/index.js\";\nimport { runUpgrade } from \"./setup/upgrade.js\";\n\ndeclare const __VERSION__: string;\n\nconst HELP = `\ntrafic-agent — Server agent for DDEV preview environments\n\nUsage:\n trafic-agent <command> [options]\n\nCommands:\n start Start the agent server\n setup Setup a new server (Docker, DDEV, hardening)\n upgrade Check for a new version, install it, run migrations, restart the service\n update Alias for upgrade\n audit Run security audit checks\n version Show version\n help Show this help\n\nStart options:\n -c, --config <path> Path to config file (default: /etc/trafic/config.toml)\n -p, --port <port> Override port from config\n\nSetup options:\n --tld <domain> TLD for DDEV projects (required on first run, reused from config on re-runs)\n --email <email> Email for Let's Encrypt certificates\n --no-hardening Skip server hardening steps\n --no-docker Skip Docker installation\n --no-ddev Skip DDEV installation\n --ssh-users <users> Comma-separated list of SSH users to allow (default: ddev)\n --dry-run Show what would be done without making changes\n\nUpgrade/update options:\n --dry-run Show what would be done without making changes\n --list List all migrations and their status (no install or restart)\n\nExamples:\n # Start the agent\n trafic-agent start\n trafic-agent start --config /path/to/config.toml\n\n # Setup a new server\n sudo trafic-agent setup --tld=previews.example.com\n sudo trafic-agent setup --tld=previews.example.com --email=admin@example.com\n sudo trafic-agent setup --tld=previews.example.com --no-hardening --dry-run\n\n # Upgrade: install latest version, run migrations, restart service\n sudo trafic-agent upgrade\n sudo trafic-agent upgrade --dry-run\n trafic-agent upgrade --list\n sudo trafic-agent update # alias for upgrade\n\n # Run security audit\n trafic-agent audit\n`;\n\nfunction printHelp(): void {\n console.log(HELP.trim());\n}\n\nfunction printVersion(): void {\n console.log(__VERSION__);\n}\n\nasync function runStart(values: Record<string, unknown>): Promise<void> {\n // Load config\n const config = loadConfig(values.config as string \| undefined);\n\n // Override port if specified\n if (values.port) {\n config.port = parseInt(values.port as string, 10);\n }\n\n // Validate config\n const errors = validateConfig(config);\n if (errors.length > 0) {\n console.error(\"Configuration errors:\");\n for (const error of errors) {\n console.error(` - ${error}`);\n }\n process.exit(1);\n }\n\n // Graceful shutdown\n const shutdown = (): void => {\n console.log(\"\\nShutting down...\");\n closeDb();\n process.exit(0);\n };\n\n process.on(\"SIGINT\", shutdown);\n process.on(\"SIGTERM\", shutdown);\n\n // Start server and scheduler\n startServer(config);\n startIdleScheduler(config);\n}\n\nfunction handleUpgrade(values: Record<string, unknown>): void {\n const dryRun = values[\"dry-run\"] as boolean \| undefined;\n const list = values.list as boolean \| undefined;\n\n if (list) {\n const entries = listMigrations();\n console.log(\"\\nMigrations:\\n\");\n\n for (const { migration, status } of entries) {\n const icon = status === \"applied\" ? \"\\x1b[32m✓\\x1b[0m\" : \"\\x1b[36m→\\x1b[0m\";\n const label = status === \"applied\" ? \"\\x1b[90m(applied)\\x1b[0m\" : \"(pending)\";\n console.log(` ${icon} \\x1b[1m${migration.id.padEnd(30)}\\x1b[0m ${migration.description.padEnd(55)} ${label}`);\n }\n\n console.log(\"\");\n return;\n }\n\n console.log(\"\\n\\x1b[1m🚦 Trafic Server Upgrade\\x1b[0m\\n\");\n\n if (dryRun) {\n console.log(\"\\x1b[33m⚠ Dry-run mode: no changes will be made\\x1b[0m\\n\");\n }\n\n runUpgrade(dryRun ?? false);\n\n if (!dryRun) {\n console.log(\"\\n\\x1b[32m✓ Upgrade complete!\\x1b[0m\\n\");\n }\n}\n\nasync function runSetup(values: Record<string, unknown>): Promise<void> {\n // Load existing config to use as defaults on re-runs\n const existingConfig = loadConfig();\n const tld = (values.tld as string \| undefined) ?? (existingConfig.tld \|\| undefined);\n\n if (!tld) {\n console.error(\"Error: --tld is required for setup\");\n console.error(\"Example: trafic-agent setup --tld=previews.example.com\");\n process.exit(1);\n }\n\n await setup({\n tld,\n email: values.email as string \| undefined,\n noHardening: values[\"no-hardening\"] as boolean \| undefined,\n noDocker: values[\"no-docker\"] as boolean \| undefined,\n noDdev: values[\"no-ddev\"] as boolean \| undefined,\n sshUsers: values[\"ssh-users\"]\n ? (values[\"ssh-users\"] as string).split(\",\").map((s) => s.trim())\n : undefined,\n dryRun: values[\"dry-run\"] as boolean \| undefined,\n });\n}\n\nasync function main(): Promise<void> {\n const { values, positionals } = parseArgs({\n allowPositionals: true,\n options: {\n // Common\n help: { type: \"boolean\", short: \"h\" },\n\n // Start options\n config: { type: \"string\", short: \"c\" },\n port: { type: \"string\", short: \"p\" },\n\n // Setup options\n tld: { type: \"string\" },\n email: { type: \"string\" },\n \"no-hardening\": { type: \"boolean\" },\n \"no-docker\": { type: \"boolean\" },\n \"no-ddev\": { type: \"boolean\" },\n \"ssh-users\": { type: \"string\" },\n \"dry-run\": { type: \"boolean\" },\n\n // Upgrade options\n list: { type: \"boolean\" },\n },\n });\n\n const command = positionals[0] ?? \"help\";\n\n if (values.help) {\n printHelp();\n process.exit(0);\n }\n\n switch (command) {\n case \"help\":\n printHelp();\n break;\n\n case \"version\":\n printVersion();\n break;\n\n case \"start\":\n await runStart(values);\n break;\n\n case \"setup\":\n await runSetup(values);\n break;\n\n case \"upgrade\":\n case \"update\":\n handleUpgrade(values);\n break;\n\n case \"audit\":\n await audit();\n break;\n\n default:\n console.error(`Unknown command: ${command}`);\n printHelp();\n process.exit(1);\n }\n}\n\nmain().catch((error) => {\n console.error(\"Fatal error:\", error);\n process.exit(1);\n});\n"],"mappings":";;;;;;;;;AAUA,SAAgB,qBAAoC;AAClD,KAAI;AACF,SAAO,SAAS,6CAA6C;GAC3D,UAAU;GACV,OAAO;GACR,CAAC,CAAC,MAAM;SACH;AACN,SAAO;;;;;;;AAQX,SAAgB,QAAQ,SAAiB,MAAuB;CAC9D,MAAM,SAAS,MAAwC;EACrD,MAAM,QAAQ,EAAE,QAAQ,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,OAAO;AACxD,SAAO;GAAC,MAAM,MAAM;GAAG,MAAM,MAAM;GAAG,MAAM,MAAM;GAAE;;CAGtD,MAAM,CAAC,MAAM,MAAM,QAAQ,MAAM,QAAQ;CACzC,MAAM,CAAC,MAAM,MAAM,QAAQ,MAAM,KAAK;AAEtC,KAAI,SAAS,KAAM,QAAO,OAAO;AACjC,KAAI,SAAS,KAAM,QAAO,OAAO;AACjC,QAAO,OAAO;;;;;AAMhB,SAAgB,mBAAmB,QAAuB;AACxD,MAAK,kDAAkD,EAAE,QAAQ,CAAC,QAAQ,CAAC;;;;;AAM7E,SAAgB,oBAAoB,QAAuB;AACzD,MAAK,kCAAkC,EAAE,QAAQ,CAAC,QAAQ,CAAC;;;;;;;;;AAU7D,SAAgB,WAAW,SAAS,OAAa;AAC/C,KAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;AACxB,UAAQ,MAAM,wDAAwD;AACtE,UAAQ,IAAI,mCAAmC;AAC/C,UAAQ,KAAK,EAAE;;AAIjB,MAAK,oBAAoB;CAEzB,MAAM,UAAA;AACN,MAAK,oBAAoB,UAAU;CAEnC,MAAM,SAAS,oBAAoB;AAEnC,KAAI,CAAC,OACH,MAAK,wDAAwD;UACpD,QAAQ,SAAS,OAAO,EAAE;AACnC,UAAQ,0BAA0B,SAAS;AAG3C,OAAK,yBAAyB;AAC9B,qBAAmB,OAAO;AAC1B,MAAI,CAAC,OACH,SAAQ,sCAAsC,SAAS;OAGzD,SAAQ,uBAAuB,QAAQ,GAAG;AAI5C,MAAK,yBAAyB;AAC9B,sBAAqB,OAAO;AAG5B,MAAK,+BAA+B;AACpC,qBAAoB,OAAO;AAC3B,KAAI,CAAC,OACH,SAAQ,oBAAoB;;ACrFhC,IAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoDb,SAAS,YAAkB;AACzB,SAAQ,IAAI,KAAK,MAAM,CAAC;;AAG1B,SAAS,eAAqB;AAC5B,SAAQ,IAAA,SAAgB;;AAG1B,eAAe,SAAS,QAAgD;CAEtE,MAAM,SAAS,WAAW,OAAO,OAA6B;AAG9D,KAAI,OAAO,KACT,QAAO,OAAO,SAAS,OAAO,MAAgB,GAAG;CAInD,MAAM,SAAS,eAAe,OAAO;AACrC,KAAI,OAAO,SAAS,GAAG;AACrB,UAAQ,MAAM,wBAAwB;AACtC,OAAK,MAAM,SAAS,OAClB,SAAQ,MAAM,OAAO,QAAQ;AAE/B,UAAQ,KAAK,EAAE;;CAIjB,MAAM,iBAAuB;AAC3B,UAAQ,IAAI,qBAAqB;AACjC,WAAS;AACT,UAAQ,KAAK,EAAE;;AAGjB,SAAQ,GAAG,UAAU,SAAS;AAC9B,SAAQ,GAAG,WAAW,SAAS;AAG/B,aAAY,OAAO;AACnB,oBAAmB,OAAO;;AAG5B,SAAS,cAAc,QAAuC;CAC5D,MAAM,SAAS,OAAO;AAGtB,KAFa,OAAO,MAEV;EACR,MAAM,UAAU,gBAAgB;AAChC,UAAQ,IAAI,kBAAkB;AAE9B,OAAK,MAAM,EAAE,WAAW,YAAY,SAAS;GAC3C,MAAM,OAAO,WAAW,YAAY,qBAAqB;GACzD,MAAM,QAAQ,WAAW,YAAY,6BAA6B;AAClE,WAAQ,IAAI,KAAK,KAAK,UAAU,UAAU,GAAG,OAAO,GAAG,CAAC,UAAU,UAAU,YAAY,OAAO,GAAG,CAAC,GAAG,QAAQ;;AAGhH,UAAQ,IAAI,GAAG;AACf;;AAGF,SAAQ,IAAI,6CAA6C;AAEzD,KAAI,OACF,SAAQ,IAAI,2DAA2D;AAGzE,YAAW,UAAU,MAAM;AAE3B,KAAI,CAAC,OACH,SAAQ,IAAI,yCAAyC;;AAIzD,eAAe,SAAS,QAAgD;CAEtE,MAAM,iBAAiB,YAAY;CACnC,MAAM,MAAO,OAAO,QAA+B,eAAe,OAAO,KAAA;AAEzE,KAAI,CAAC,KAAK;AACR,UAAQ,MAAM,qCAAqC;AACnD,UAAQ,MAAM,yDAAyD;AACvE,UAAQ,KAAK,EAAE;;AAGjB,OAAM,MAAM;EACV;EACA,OAAO,OAAO;EACd,aAAa,OAAO;EACpB,UAAU,OAAO;EACjB,QAAQ,OAAO;EACf,UAAU,OAAO,eACZ,OAAO,aAAwB,MAAM,IAAI,CAAC,KAAK,MAAM,EAAE,MAAM,CAAC,GAC/D,KAAA;EACJ,QAAQ,OAAO;EAChB,CAAC;;AAGJ,eAAe,OAAsB;CACnC,MAAM,EAAE,QAAQ,gBAAgB,UAAU;EACxC,kBAAkB;EAClB,SAAS;GAEP,MAAM;IAAE,MAAM;IAAW,OAAO;IAAK;GAGrC,QAAQ;IAAE,MAAM;IAAU,OAAO;IAAK;GACtC,MAAM;IAAE,MAAM;IAAU,OAAO;IAAK;GAGpC,KAAK,EAAE,MAAM,UAAU;GACvB,OAAO,EAAE,MAAM,UAAU;GACzB,gBAAgB,EAAE,MAAM,WAAW;GACnC,aAAa,EAAE,MAAM,WAAW;GAChC,WAAW,EAAE,MAAM,WAAW;GAC9B,aAAa,EAAE,MAAM,UAAU;GAC/B,WAAW,EAAE,MAAM,WAAW;GAG9B,MAAM,EAAE,MAAM,WAAW;GAC1B;EACF,CAAC;CAEF,MAAM,UAAU,YAAY,MAAM;AAElC,KAAI,OAAO,MAAM;AACf,aAAW;AACX,UAAQ,KAAK,EAAE;;AAGjB,SAAQ,SAAR;EACE,KAAK;AACH,cAAW;AACX;EAEF,KAAK;AACH,iBAAc;AACd;EAEF,KAAK;AACH,SAAM,SAAS,OAAO;AACtB;EAEF,KAAK;AACH,SAAM,SAAS,OAAO;AACtB;EAEF,KAAK;EACL,KAAK;AACH,iBAAc,OAAO;AACrB;EAEF,KAAK;AACH,SAAM,OAAO;AACb;EAEF;AACE,WAAQ,MAAM,oBAAoB,UAAU;AAC5C,cAAW;AACX,WAAQ,KAAK,EAAE;;;AAIrB,MAAM,CAAC,OAAO,UAAU;AACtB,SAAQ,MAAM,gBAAgB,MAAM;AACpC,SAAQ,KAAK,EAAE;EACf"}

package/dist/index.js CHANGED Viewed

@@ -1,3 +1,3 @@
-import { a as printAuditResults, c as stopIdleProjects, d as validateConfig, l as loadConfig, n as setup, o as runAudit, s as startIdleScheduler, t as audit, u as parseDuration } from "./setup-DGwXLdk_.js";
+import { _ as validateConfig, a as printAuditResults, g as parseDuration, h as loadConfig, m as stopIdleProjects, n as setup, o as runAudit, p as startIdleScheduler, t as audit } from "./setup-_IJ40DuS.js";
 import { C as checkAuth, D as parseBearerToken, E as parseBasicAuth, S as watchProjectList, T as matchIp, _ as getProjectInfo, a as cleanOldLogs, b as startProject, c as getDb, d as initDb, f as logAccess, g as getProjectFromHostname, h as buildHostnameIndex, i as shouldNeverStop, l as getIdleProjects, m as updateProjectAccess, n as getIdleTimeoutMs, o as closeDb, p as setProjectStatus, r as loadProjectConfig, s as getAccessLogs, t as startServer, u as getProject, v as listProjects, w as matchHostname, x as stopProject, y as loadProjectList } from "./server-D6zlodZz.js";
 export { audit, buildHostnameIndex, checkAuth, cleanOldLogs, closeDb, getAccessLogs, getDb, getIdleProjects, getIdleTimeoutMs, getProject, getProjectFromHostname, getProjectInfo, initDb, listProjects, loadConfig, loadProjectConfig, loadProjectList, logAccess, matchHostname, matchIp, parseBasicAuth, parseBearerToken, parseDuration, printAuditResults, runAudit, setProjectStatus, setup, shouldNeverStop, startIdleScheduler, startProject, startServer, stopIdleProjects, stopProject, updateProjectAccess, validateConfig, watchProjectList };

package/dist/setup/migrations/0003__ddev_router_bind_all_interfaces.d.ts ADDED Viewed

@@ -0,0 +1,15 @@
+import type { Migration } from "../types.js";
+/**
+ * Migration 0003: Enable router_bind_all_interfaces in DDEV global config.
+ *
+ * The initial setup did not set --router-bind-all-interfaces=true, which
+ * caused ddev-router to bind only on 127.0.0.1. External traffic (including
+ * Cloudflare proxying) could not reach the router, resulting in 521 errors.
+ *
+ * This migration enables the flag and restarts the DDEV router so the change
+ * takes effect immediately.
+ *
+ * Idempotent: ddev config global is safe to re-run with the same value.
+ */
+export declare const migration0003DdevRouterBindAllInterfaces: Migration;
+//# sourceMappingURL=0003__ddev_router_bind_all_interfaces.d.ts.map

package/dist/setup/migrations/0003__ddev_router_bind_all_interfaces.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"0003__ddev_router_bind_all_interfaces.d.ts","sourceRoot":"","sources":["../../../src/setup/migrations/0003__ddev_router_bind_all_interfaces.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wCAAwC,EAAE,SAQtD,CAAC"}

package/dist/setup/migrations/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/setup/migrations/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;~~AAIjF~~,iDAAiD;AACjD,eAAO,MAAM,qBAAqB,iCAAiC,CAAC;AAEpE,+CAA+C;AAC/C,eAAO,MAAM,cAAc,EAAE,SAAS,~~EAA4D~~,CAAC;~~AAMnG~~;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,cAAc,CAqBnD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAG9D;AAMD;;GAEG;AACH,wBAAgB,cAAc,IAAI,kBAAkB,EAAE,CAMrD;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,UAAQ,GAAG,IAAI,CAyBzD;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CAU/C"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/setup/migrations/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAKjF,iDAAiD;AACjD,eAAO,MAAM,qBAAqB,iCAAiC,CAAC;AAEpE,+CAA+C;AAC/C,eAAO,MAAM,cAAc,EAAE,SAAS,EAIrC,CAAC;AAMF;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,cAAc,CAqBnD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAG9D;AAMD;;GAEG;AACH,wBAAgB,cAAc,IAAI,kBAAkB,EAAE,CAMrD;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,UAAQ,GAAG,IAAI,CAyBzD;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CAU/C"}

package/dist/setup/upgrade.d.ts ADDED Viewed

@@ -0,0 +1,27 @@
+/**
+ * Fetch the latest published version of @studiometa/trafic-agent from the npm registry.
+ * Returns null if the registry is unreachable.
+ */
+export declare function fetchLatestVersion(): string | null;
+/**
+ * Compare two semver strings. Returns true if `next` is strictly greater than `current`.
+ * Handles simple MAJOR.MINOR.PATCH without pre-release suffixes.
+ */
+export declare function isNewer(current: string, next: string): boolean;
+/**
+ * Install the latest version of @studiometa/trafic-agent globally via npm.
+ */
+export declare function installLatestAgent(dryRun: boolean): void;
+/**
+ * Restart the trafic-agent systemd service.
+ */
+export declare function restartAgentService(dryRun: boolean): void;
+/**
+ * Full upgrade sequence:
+ *  1. Check for a new version on npm
+ *  2. Install it globally if one is found
+ *  3. Run pending migrations
+ *  4. Restart the systemd service
+ */
+export declare function runUpgrade(dryRun?: boolean): void;
+//# sourceMappingURL=upgrade.d.ts.map

package/dist/setup/upgrade.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"upgrade.d.ts","sourceRoot":"","sources":["../../src/setup/upgrade.ts"],"names":[],"mappings":"AAMA;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,IAAI,CASlD;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAY9D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAExD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAEzD;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,MAAM,UAAQ,GAAG,IAAI,CAwC/C"}

package/dist/{setup-DGwXLdk_.js → setup-_IJ40DuS.js} RENAMED Viewed

@@ -349,7 +349,7 @@ function installDdev() {
 function configureDdev(tld, email) {
 	step("Configure DDEV");
 	const ddevCmd = (cmd) => `su - ddev -c '${cmd}'`;
-	exec(ddevCmd(`ddev config global --project-tld=${tld} --router-http-port=80 --router-https-port=443 --use-letsencrypt=${email ? "true" : "false"} ${email ? `--letsencrypt-email=${email}` : ""} --instrumentation-opt-in=false`), { silent: true });
+	exec(ddevCmd(`ddev config global --project-tld=${tld} --router-http-port=80 --router-https-port=443 --router-bind-all-interfaces=true --use-letsencrypt=${email ? "true" : "false"} ${email ? `--letsencrypt-email=${email}` : ""} --instrumentation-opt-in=false`), { silent: true });
 	success(`DDEV configured with TLD: ${tld}`);
 	info(`Ensure DNS is configured: *.${tld} → server IP`);
 	if (email) success(`Let's Encrypt enabled with email: ${email}`);
@@ -917,10 +917,34 @@ const migration0002MkcertDdevUser = {
 		exec("chown -R ddev:ddev /home/ddev/.local/share/mkcert", { silent: true });
 	}
 };
+/**
+* Migration 0003: Enable router_bind_all_interfaces in DDEV global config.
+*
+* The initial setup did not set --router-bind-all-interfaces=true, which
+* caused ddev-router to bind only on 127.0.0.1. External traffic (including
+* Cloudflare proxying) could not reach the router, resulting in 521 errors.
+*
+* This migration enables the flag and restarts the DDEV router so the change
+* takes effect immediately.
+*
+* Idempotent: ddev config global is safe to re-run with the same value.
+*/
+const migration0003DdevRouterBindAllInterfaces = {
+	id: "0003__ddev_router_bind_all_interfaces",
+	description: "Bind ddev-router on all interfaces (fix 521 for external traffic)",
+	run() {
+		exec("su - ddev -c 'ddev config global --router-bind-all-interfaces=true'", { silent: true });
+		exec("su - ddev -c 'ddev restart router'", { silent: true });
+	}
+};
 /** Path to the persisted migration state file */
 const MIGRATIONS_STATE_FILE = "/etc/trafic/.migrations.json";
 /** Ordered registry of all known migrations */
-const ALL_MIGRATIONS = [migration0001DdevAptRepo, migration0002MkcertDdevUser];
+const ALL_MIGRATIONS = [
+	migration0001DdevAptRepo,
+	migration0002MkcertDdevUser,
+	migration0003DdevRouterBindAllInterfaces
+];
 /**
 * Load the current migration state from disk.
 * Returns an empty state if the file does not exist yet.
@@ -1054,6 +1078,6 @@ async function audit() {
 	printAuditResults(checks);
 	if (checks.filter((c) => c.status === "fail").length > 0) process.exit(1);
 }
-export { printAuditResults as a, stopIdleProjects as c, validateConfig as d, runPendingMigrations as i, loadConfig as l, setup as n, runAudit as o, listMigrations as r, startIdleScheduler as s, audit as t, parseDuration as u };
+export { validateConfig as _, printAuditResults as a, info as c, success as d, warn as f, parseDuration as g, loadConfig as h, runPendingMigrations as i, isRoot as l, stopIdleProjects as m, setup as n, runAudit as o, startIdleScheduler as p, listMigrations as r, exec as s, audit as t, step as u };
-//# sourceMappingURL=setup-DGwXLdk_.js.map
+//# sourceMappingURL=setup-_IJ40DuS.js.map

package/dist/setup-_IJ40DuS.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"setup-_IJ40DuS.js","names":[],"sources":["../src/utils/config.ts","../src/tasks/stop-idle.ts","../src/setup/steps.ts","../src/setup/user.ts","../src/setup/docker.ts","../src/setup/ddev.ts","../src/setup/agent.ts","../src/setup/hardening.ts","../src/setup/audit.ts","../src/setup/migrations/0001__ddev_apt_repo.ts","../src/setup/migrations/0002__mkcert_ddev_user.ts","../src/setup/migrations/0003__ddev_router_bind_all_interfaces.ts","../src/setup/migrations/index.ts","../src/setup/index.ts"],"sourcesContent":["import { readFileSync, existsSync } from \"node:fs\";\nimport { parse } from \"smol-toml\";\nimport type { AgentConfig, AuthConfig, AuthRule } from \"../types.js\";\n\nconst DEFAULT_CONFIG_PATHS = [\n \"/etc/trafic/config.toml\",\n \"./config.toml\",\n \"./trafic.toml\",\n];\n\nconst DEFAULT_CONFIG: AgentConfig = {\n tld: \"\",\n port: 9876,\n dbPath: \"/var/lib/trafic/db.sqlite\",\n projectListPath: \"/home/ddev/.ddev/project_list.yaml\",\n projectsDir: \"/home/ddev/www\",\n idleTimeout: \"30m\",\n idleCheckInterval: \"5m\",\n auth: {\n defaultPolicy: \"basic\",\n allowedIps: [],\n tokens: [],\n basicAuth: [],\n rules: [],\n },\n};\n\n/**\n * Parse a duration string (e.g., \"30m\", \"1h\", \"2h30m\") to milliseconds\n */\nexport function parseDuration(duration: string): number {\n const regex = /(?:(\\d+)h)?(?:(\\d+)m)?(?:(\\d+)s)?/;\n const match = duration.match(regex);\n if (!match) return 0;\n\n const hours = parseInt(match[1] ?? \"0\", 10);\n const minutes = parseInt(match[2] ?? \"0\", 10);\n const seconds = parseInt(match[3] ?? \"0\", 10);\n\n return (hours * 3600 + minutes * 60 + seconds) * 1000;\n}\n\n/**\n * Load configuration from TOML file\n */\nexport function loadConfig(configPath?: string): AgentConfig {\n // Find config file\n let path = configPath;\n if (!path) {\n path = DEFAULT_CONFIG_PATHS.find((p) => existsSync(p));\n }\n\n if (!path || !existsSync(path)) {\n console.warn(\"No config file found, using defaults\");\n return DEFAULT_CONFIG;\n }\n\n const content = readFileSync(path, \"utf-8\");\n const parsed = parse(content) as Record<string, unknown>;\n\n // Merge with defaults\n const auth = mergeAuthConfig(parsed.auth as Record<string, unknown>);\n\n return {\n tld: (parsed.tld as string) ?? DEFAULT_CONFIG.tld,\n port: (parsed.port as number) ?? DEFAULT_CONFIG.port,\n dbPath: (parsed.db_path as string) ?? DEFAULT_CONFIG.dbPath,\n projectListPath:\n (parsed.project_list_path as string) ?? DEFAULT_CONFIG.projectListPath,\n projectsDir: (parsed.projects_dir as string) ?? DEFAULT_CONFIG.projectsDir,\n idleTimeout:\n (parsed.idle_timeout as string) ?? DEFAULT_CONFIG.idleTimeout,\n idleCheckInterval:\n (parsed.idle_check_interval as string) ??\n DEFAULT_CONFIG.idleCheckInterval,\n auth,\n };\n}\n\nfunction mergeAuthConfig(raw?: Record<string, unknown>): AuthConfig {\n if (!raw) return DEFAULT_CONFIG.auth;\n\n const rules = (raw.rules as Array<Record<string, unknown>>) ?? [];\n\n return {\n defaultPolicy:\n (raw.default_policy as AuthConfig[\"defaultPolicy\"]) ??\n DEFAULT_CONFIG.auth.defaultPolicy,\n allowedIps:\n (raw.allowed_ips as string[]) ?? DEFAULT_CONFIG.auth.allowedIps,\n tokens: (raw.tokens as string[]) ?? DEFAULT_CONFIG.auth.tokens,\n basicAuth: (raw.basic_auth as string[]) ?? DEFAULT_CONFIG.auth.basicAuth,\n rules: rules.map(\n (r): AuthRule => ({\n match: r.match as string,\n policy: r.policy as AuthRule[\"policy\"],\n tokens: r.tokens as string[] | undefined,\n allowedIps: r.allowed_ips as string[] | undefined,\n }),\n ),\n };\n}\n\n/**\n * Validate configuration\n */\nexport function validateConfig(config: AgentConfig): string[] {\n const errors: string[] = [];\n\n if (!config.tld) {\n errors.push(\"tld is required\");\n }\n\n if (config.port < 1 || config.port > 65535) {\n errors.push(\"port must be between 1 and 65535\");\n }\n\n if (\n config.auth.defaultPolicy !== \"allow\" &&\n config.auth.defaultPolicy !== \"deny\" &&\n config.auth.defaultPolicy !== \"basic\" &&\n config.auth.defaultPolicy !== \"token\"\n ) {\n errors.push('auth.default_policy must be \"allow\", \"deny\", \"basic\", or \"token\"');\n }\n\n return errors;\n}\n","import { getIdleProjects, setProjectStatus } from \"../utils/db.js\";\nimport { stopProject, getProjectInfo, loadProjectList } from \"../utils/ddev.js\";\nimport { parseDuration } from \"../utils/config.js\";\nimport { loadProjectConfig, shouldNeverStop, getIdleTimeoutMs } from \"../utils/project-config.js\";\nimport type { AgentConfig } from \"../types.js\";\n\n/**\n * Stop idle projects that haven't been accessed recently\n * Respects per-project idle_timeout settings from .ddev/config.trafic.yaml\n */\nexport function stopIdleProjects(config: AgentConfig): void {\n const globalThresholdMs = parseDuration(config.idleTimeout);\n\n // Get all projects to check their individual configs\n const projects = loadProjectList(config.projectListPath);\n\n // Get projects idle according to global threshold\n const idleProjects = getIdleProjects(globalThresholdMs);\n\n for (const project of idleProjects) {\n const projectDir = projects.get(project.name);\n\n // Load per-project config if available\n if (projectDir) {\n const projectConfig = loadProjectConfig(projectDir);\n\n // Skip if project is configured to never stop\n if (shouldNeverStop(projectConfig)) {\n continue;\n }\n\n // Check project-specific idle timeout\n const projectThresholdMs = getIdleTimeoutMs(projectConfig);\n if (projectThresholdMs !== undefined) {\n const idleDuration = Date.now() - project.lastAccess;\n if (idleDuration < projectThresholdMs) {\n // Not idle according to project-specific timeout\n continue;\n }\n }\n }\n\n // Double-check project is actually running via DDEV\n const info = getProjectInfo(project.name);\n if (info?.status !== \"running\") {\n // Already stopped, just update our record\n setProjectStatus(project.name, \"stopped\");\n continue;\n }\n\n console.log(`Stopping idle project: ${project.name}`);\n const success = stopProject(project.name);\n\n if (success) {\n setProjectStatus(project.name, \"stopped\");\n console.log(`Stopped: ${project.name}`);\n } else {\n console.error(`Failed to stop: ${project.name}`);\n }\n }\n}\n\n/**\n * Start the idle check scheduler\n */\nexport function startIdleScheduler(config: AgentConfig): NodeJS.Timeout {\n const intervalMs = parseDuration(config.idleCheckInterval);\n\n console.log(\n `Idle scheduler started: checking every ${config.idleCheckInterval}, timeout ${config.idleTimeout}`,\n );\n\n // Run immediately on start\n stopIdleProjects(config);\n\n // Then run on interval\n return setInterval(() => {\n stopIdleProjects(config);\n }, intervalMs);\n}\n","import { execSync } from \"node:child_process\";\nimport { writeFileSync as fsWriteFile } from \"node:fs\";\n\nlet stepNumber = 0;\nlet dryRun = false;\n\n/**\n * Set dry-run mode\n */\nexport function setDryRun(value: boolean): void {\n dryRun = value;\n}\n\n/**\n * Reset step counter\n */\nexport function resetSteps(): void {\n stepNumber = 0;\n}\n\n/**\n * Log a step\n */\nexport function step(message: string): void {\n stepNumber++;\n console.log(`\\n\\x1b[36m[${stepNumber}]\\x1b[0m ${message}`);\n}\n\n/**\n * Log success\n */\nexport function success(message: string): void {\n console.log(` \\x1b[32m✓\\x1b[0m ${message}`);\n}\n\n/**\n * Log warning\n */\nexport function warn(message: string): void {\n console.log(` \\x1b[33m⚠\\x1b[0m ${message}`);\n}\n\n/**\n * Log error\n */\nexport function error(message: string): void {\n console.log(` \\x1b[31m✗\\x1b[0m ${message}`);\n}\n\n/**\n * Log info\n */\nexport function info(message: string): void {\n console.log(` ${message}`);\n}\n\n/**\n * Execute a command (or show in dry-run mode)\n */\nexport function exec(command: string, options?: { silent?: boolean }): string {\n if (dryRun) {\n if (!options?.silent) {\n console.log(` \\x1b[90m$ ${command}\\x1b[0m`);\n }\n return \"\";\n }\n\n try {\n return execSync(command, {\n encoding: \"utf-8\",\n stdio: options?.silent ? \"pipe\" : \"inherit\",\n });\n } catch (err) {\n const e = err as { status?: number; stderr?: string };\n throw new Error(`Command failed: ${command}\\n${e.stderr ?? \"\"}`);\n }\n}\n\n/**\n * Execute a command and return output (silent)\n */\nexport function execSilent(command: string): string {\n if (dryRun) {\n return \"\";\n }\n\n try {\n return execSync(command, {\n encoding: \"utf-8\",\n stdio: \"pipe\",\n }).trim();\n } catch {\n return \"\";\n }\n}\n\n/**\n * Check if a command exists\n */\nexport function commandExists(command: string): boolean {\n try {\n execSync(`which ${command}`, { stdio: \"pipe\" });\n return true;\n } catch {\n return false;\n }\n}\n\n/**\n * Check if running as root\n */\nexport function isRoot(): boolean {\n return process.getuid?.() === 0;\n}\n\n/**\n * Write a file (or show in dry-run mode)\n */\nexport function writeFile(path: string, content: string): void {\n if (dryRun) {\n console.log(` \\x1b[90mWrite ${path}:\\x1b[0m`);\n const lines = content.split(\"\\n\").slice(0, 5);\n for (const line of lines) {\n console.log(` \\x1b[90m ${line}\\x1b[0m`);\n }\n if (content.split(\"\\n\").length > 5) {\n console.log(` \\x1b[90m ...\\x1b[0m`);\n }\n return;\n }\n\n fsWriteFile(path, content);\n}\n","import { step, success, info, exec, execSilent, warn } from \"./steps.js\";\n\n/**\n * Create the ddev user with proper permissions\n */\nexport function createDdevUser(): void {\n step(\"Create ddev user\");\n\n // Check if user exists\n const userExists = execSilent(\"id -u ddev 2>/dev/null\");\n if (userExists) {\n info(\"User 'ddev' already exists\");\n } else {\n exec(\"useradd -m -s /bin/bash ddev\");\n success(\"Created user 'ddev'\");\n }\n\n // Add to docker group (will be created by Docker install)\n exec(\"usermod -aG docker ddev 2>/dev/null || true\", { silent: true });\n\n // Create www directory\n exec(\"mkdir -p /home/ddev/www\");\n exec(\"chown ddev:ddev /home/ddev/www\");\n exec(\"chmod 750 /home/ddev/www\");\n success(\"Created /home/ddev/www\");\n\n // Create .ssh directory if needed\n exec(\"mkdir -p /home/ddev/.ssh\");\n exec(\"chmod 700 /home/ddev/.ssh\");\n exec(\"chown ddev:ddev /home/ddev/.ssh\");\n\n // Note: ddev user doesn't need sudo when DNS is properly configured\n // - Docker access: via docker group membership\n // - DDEV: runs as regular user, no sudo needed\n // - Agent: runs as systemd service (root manages it)\n // - Hostname resolution: via DNS (*.tld → server IP), not /etc/hosts\n //\n // If DNS is NOT configured for the custom TLD, DDEV will try to edit\n // /etc/hosts which requires sudo. In that case, you'd need:\n // echo \"ddev ALL=(ALL) NOPASSWD: /usr/local/bin/ddev-hostname\" >> /etc/sudoers.d/ddev\n // But it's better to just configure DNS properly.\n success(\"User ddev configured (no sudo needed with proper DNS)\");\n}\n\n/**\n * Setup authorized_keys for ddev user\n */\nexport function setupAuthorizedKeys(publicKey?: string): void {\n if (!publicKey) {\n warn(\"No SSH public key provided, skipping authorized_keys setup\");\n return;\n }\n\n step(\"Setup SSH authorized_keys\");\n\n const authKeysPath = \"/home/ddev/.ssh/authorized_keys\";\n exec(`touch ${authKeysPath}`);\n exec(`chmod 600 ${authKeysPath}`);\n exec(`chown ddev:ddev ${authKeysPath}`);\n\n // Check if key already exists\n const existing = execSilent(`cat ${authKeysPath}`);\n if (existing.includes(publicKey.trim())) {\n info(\"SSH key already authorized\");\n } else {\n exec(`echo '${publicKey}' >> ${authKeysPath}`);\n success(\"Added SSH public key\");\n }\n}\n","import { writeFileSync, existsSync, readFileSync } from \"node:fs\";\nimport { step, success, info, exec, commandExists, warn } from \"./steps.js\";\n\n/**\n * Install Docker using the official script\n */\nexport function installDocker(): void {\n step(\"Install Docker\");\n\n if (commandExists(\"docker\")) {\n const version = exec(\"docker --version\", { silent: true });\n info(`Docker already installed: ${version?.trim() ?? \"unknown version\"}`);\n return;\n }\n\n // Install Docker using official script\n info(\"Downloading and running Docker install script...\");\n exec(\"curl -fsSL https://get.docker.com -o /tmp/get-docker.sh\");\n exec(\"sh /tmp/get-docker.sh\", { silent: true });\n exec(\"rm /tmp/get-docker.sh\");\n\n // Enable and start Docker\n exec(\"systemctl enable docker\", { silent: true });\n exec(\"systemctl start docker\", { silent: true });\n\n success(\"Docker installed and started\");\n\n // Add ddev user to docker group\n exec(\"usermod -aG docker ddev\", { silent: true });\n success(\"Added ddev user to docker group\");\n}\n\n/**\n * Configure Docker for production use\n */\nexport function configureDocker(): void {\n step(\"Configure Docker\");\n\n // Create daemon.json with production settings\n const daemonConfig = {\n \"log-driver\": \"json-file\",\n \"log-opts\": {\n \"max-size\": \"10m\",\n \"max-file\": \"3\",\n },\n \"storage-driver\": \"overlay2\",\n \"live-restore\": true,\n };\n\n exec(\"mkdir -p /etc/docker\");\n\n const configPath = \"/etc/docker/daemon.json\";\n\n // Check if config already exists\n if (existsSync(configPath)) {\n try {\n const existing = JSON.parse(readFileSync(configPath, \"utf-8\"));\n // Merge with existing config\n const merged = { ...existing, ...daemonConfig };\n writeFileSync(configPath, JSON.stringify(merged, null, 2));\n info(\"Merged with existing Docker config\");\n } catch {\n warn(\"Could not parse existing Docker config, skipping\");\n return;\n }\n } else {\n writeFileSync(configPath, JSON.stringify(daemonConfig, null, 2));\n }\n\n // Reload Docker to apply config\n exec(\"systemctl reload docker || systemctl restart docker\");\n success(\"Docker configured with production settings\");\n}\n\n/**\n * Setup Docker system prune cron job\n */\nexport function setupDockerPrune(): void {\n step(\"Setup Docker cleanup cron\");\n\n const cronContent = `# Trafic: Clean up Docker resources weekly\n0 3 * * 0 root docker system prune -af --volumes 2>&1 | logger -t docker-prune\n`;\n\n writeFileSync(\"/etc/cron.d/trafic-docker-prune\", cronContent);\n exec(\"chmod 644 /etc/cron.d/trafic-docker-prune\");\n\n success(\"Docker prune scheduled weekly at 3am on Sundays\");\n}\n","import { writeFileSync } from \"node:fs\";\nimport { step, success, info, exec, commandExists } from \"./steps.js\";\n\n/**\n * Install system dependencies required by Trafic\n */\nexport function installSystemDeps(): void {\n step(\"Install system dependencies\");\n\n exec(\"apt-get update -qq\", { silent: true });\n exec(\"DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y jq curl rsync\", { silent: true });\n\n success(\"System dependencies installed: jq, curl, rsync\");\n}\n\n/**\n * Add the official DDEV apt repository and GPG key.\n * Idempotent: safe to call even if the repository is already configured.\n */\nexport function addDdevAptRepo(): void {\n exec(\"install -m 0755 -d /etc/apt/keyrings\", { silent: true });\n exec(\n \"curl -fsSL https://pkg.ddev.com/apt/gpg.key | gpg --dearmor | tee /etc/apt/keyrings/ddev.gpg > /dev/null\",\n { silent: true },\n );\n exec(\"chmod a+r /etc/apt/keyrings/ddev.gpg\", { silent: true });\n exec(\n \"echo \\\"deb [signed-by=/etc/apt/keyrings/ddev.gpg] https://pkg.ddev.com/apt/ * *\\\" | tee /etc/apt/sources.list.d/ddev.list > /dev/null\",\n { silent: true },\n );\n}\n\n/**\n * Install DDEV\n */\nexport function installDdev(): void {\n step(\"Install DDEV\");\n\n if (commandExists(\"ddev\")) {\n const version = exec(\"ddev --version 2>/dev/null | head -1\", { silent: true });\n info(`DDEV already installed: ${version?.trim() ?? \"unknown version\"}`);\n return;\n }\n\n // Install DDEV via the official apt repository\n // See https://docs.ddev.com/en/stable/users/install/ddev-installation/#debianubuntu\n info(\"Adding DDEV apt repository...\");\n addDdevAptRepo();\n\n info(\"Installing DDEV...\");\n exec(\"apt-get update -qq\", { silent: true });\n exec(\"DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y ddev\", { silent: true });\n\n // Initialize mkcert certificate authority for the ddev user.\n // mkcert installs the CA into the home directory of the current user.\n // Since setup runs as root, we must point HOME to the ddev user's home\n // so the CA is trusted by DDEV when it runs as that user.\n exec(\"HOME=/home/ddev mkcert -install\", { silent: true });\n exec(\"chown -R ddev:ddev /home/ddev/.local/share/mkcert\", { silent: true });\n\n const version = exec(\"ddev --version 2>/dev/null | head -1\", { silent: true });\n success(`DDEV installed: ${version?.trim() ?? \"unknown version\"}`);\n}\n\n/**\n * Configure DDEV global settings for production\n *\n * Note on DNS and /etc/hosts:\n * When using a custom TLD (not ddev.site), DDEV may try to edit /etc/hosts\n * if it can't resolve project hostnames via DNS. To avoid this:\n * 1. Configure DNS so *.{tld} resolves to the server's IP (recommended)\n * 2. Or install dnsmasq for local wildcard DNS resolution\n *\n * With proper DNS, DDEV won't need sudo for hostname management.\n */\nexport function configureDdev(tld: string, email?: string): void {\n step(\"Configure DDEV\");\n\n // Run as ddev user\n const ddevCmd = (cmd: string) => `su - ddev -c '${cmd}'`;\n\n // Configure all global settings in a single call\n exec(\n ddevCmd(\n `ddev config global --project-tld=${tld} --router-http-port=80 --router-https-port=443 --router-bind-all-interfaces=true --use-letsencrypt=${email ? \"true\" : \"false\"} ${email ? `--letsencrypt-email=${email}` : \"\"} --instrumentation-opt-in=false`,\n ),\n { silent: true },\n );\n\n success(`DDEV configured with TLD: ${tld}`);\n info(`Ensure DNS is configured: *.${tld} → server IP`);\n\n if (email) {\n success(`Let's Encrypt enabled with email: ${email}`);\n }\n\n success(\"DDEV global settings configured\");\n}\n\n/**\n * Install dnsmasq for local DNS resolution (optional)\n * This allows the server itself to resolve *.{tld} hostnames\n * without needing to edit /etc/hosts for each project\n */\nexport function installDnsmasq(tld: string): void {\n step(\"Install dnsmasq for local DNS\");\n\n exec(\"apt-get update && apt-get install -y dnsmasq\", { silent: true });\n\n // Get server's public IP\n const serverIp = exec(\n \"curl -4 -s ifconfig.me || hostname -I | awk '{print $1}'\",\n { silent: true },\n )?.trim() || \"127.0.0.1\";\n\n // Configure dnsmasq to resolve *.{tld} to server IP\n const dnsmasqConfig = `# Trafic: Local DNS for DDEV projects\n# Resolve all *.${tld} to this server\naddress=/${tld}/${serverIp}\n\n# Don't read /etc/resolv.conf\nno-resolv\n\n# Use upstream DNS for everything else\nserver=1.1.1.1\nserver=8.8.8.8\n\n# Listen on localhost only\nlisten-address=127.0.0.1\nbind-interfaces\n`;\n\n writeFileSync(\"/etc/dnsmasq.d/trafic.conf\", dnsmasqConfig);\n\n // Configure system to use local dnsmasq\n exec(\"systemctl restart dnsmasq\");\n exec(\"systemctl enable dnsmasq\");\n\n // Update resolv.conf to use local DNS first\n info(\"Configure /etc/resolv.conf to use 127.0.0.1 as primary DNS\");\n\n success(`dnsmasq configured: *.${tld} → ${serverIp}`);\n}\n\n/**\n * Configure Traefik for forward auth\n */\nexport function configureTraefik(): void {\n step(\"Configure Traefik for forward auth\");\n\n // Create custom Traefik config directory\n exec(\"mkdir -p /home/ddev/.ddev/traefik\", { silent: true });\n exec(\"chown -R ddev:ddev /home/ddev/.ddev\", { silent: true });\n\n // Static configuration for Trafic middleware\n const staticConfig = `# Trafic: Forward auth middleware\nhttp:\n middlewares:\n trafic-auth:\n forwardAuth:\n address: \"http://host.docker.internal:9876/__auth__\"\n authResponseHeaders:\n - \"X-Trafic-Project\"\n\n trafic-errors:\n errors:\n status:\n - \"502\"\n - \"503\"\n service: trafic-service\n query: \"/\"\n\n services:\n trafic-service:\n loadBalancer:\n servers:\n - url: \"http://host.docker.internal:9876\"\n`;\n\n writeFileSync(\"/home/ddev/.ddev/traefik/trafic.yaml\", staticConfig);\n exec(\"chown ddev:ddev /home/ddev/.ddev/traefik/trafic.yaml\", { silent: true });\n\n // Create default router config that applies middleware to all projects\n const routerConfig = `# Trafic: Default router configuration\n# This file makes all DDEV projects use the Trafic auth middleware\nhttp:\n routers:\n trafic-catch-all:\n rule: \"HostRegexp(\\`.+\\`)\"\n priority: 1\n middlewares:\n - trafic-auth\n - trafic-errors\n service: api@internal\n`;\n\n writeFileSync(\"/home/ddev/.ddev/traefik/dynamic.yaml\", routerConfig);\n exec(\"chown ddev:ddev /home/ddev/.ddev/traefik/dynamic.yaml\", { silent: true });\n\n success(\"Traefik configured with Trafic middleware\");\n}\n","import { step, success, info, exec, commandExists } from \"./steps.js\";\nimport { writeFileSync, existsSync } from \"node:fs\";\n\n/**\n * Install Node.js using fnm\n */\nexport function installNode(): void {\n step(\"Install Node.js\");\n\n // Check if Node is already installed\n if (commandExists(\"node\")) {\n const version = exec(\"node --version\", { silent: true });\n info(`Node.js already installed: ${version?.trim()}`);\n return;\n }\n\n // Install fnm (Fast Node Manager)\n exec(\n 'curl -fsSL https://fnm.vercel.app/install | bash -s -- --install-dir \"/opt/fnm\" --skip-shell',\n );\n\n // Add fnm to system path\n const profileContent = `# Trafic: fnm (Node.js version manager)\nexport FNM_DIR=\"/opt/fnm\"\nexport PATH=\"/opt/fnm:$PATH\"\neval \"$(fnm env)\"\n`;\n\n writeFileSync(\"/etc/profile.d/fnm.sh\", profileContent);\n exec(\"chmod 644 /etc/profile.d/fnm.sh\");\n\n // Install Node.js 24\n exec(\"export FNM_DIR=/opt/fnm && /opt/fnm/fnm install 24\");\n exec(\"export FNM_DIR=/opt/fnm && /opt/fnm/fnm default 24\");\n\n // Create symlinks for system-wide access\n exec(\n \"ln -sf /opt/fnm/aliases/default/bin/node /usr/local/bin/node || true\",\n );\n exec(\"ln -sf /opt/fnm/aliases/default/bin/npm /usr/local/bin/npm || true\");\n exec(\"ln -sf /opt/fnm/aliases/default/bin/npx /usr/local/bin/npx || true\");\n\n success(\"Node.js 24 installed via fnm\");\n}\n\n/**\n * Install the Trafic agent\n */\nexport function installAgent(): void {\n step(\"Install Trafic agent\");\n\n // Install the agent globally\n exec(\"npm install -g @studiometa/trafic-agent\");\n\n success(\"Trafic agent installed\");\n}\n\n/**\n * Create the agent configuration\n */\nexport function createAgentConfig(tld: string, _email?: string): void {\n step(\"Create agent configuration\");\n\n // Create directories\n exec(\"mkdir -p /etc/trafic\");\n exec(\"mkdir -p /var/lib/trafic\");\n exec(\"chown ddev:ddev /var/lib/trafic\");\n\n const configPath = \"/etc/trafic/config.toml\";\n\n if (existsSync(configPath)) {\n info(\"Configuration already exists at /etc/trafic/config.toml — skipping\");\n info(\"Edit this file to configure authentication\");\n return;\n }\n\n const config = `# Trafic agent configuration\n# Generated by trafic setup\n\n# Required: TLD for DDEV projects\ntld = \"${tld}\"\n\n# Agent HTTP server port\nport = 9876\n\n# Database and paths\ndb_path = \"/var/lib/trafic/db.sqlite\"\nproject_list_path = \"/home/ddev/.ddev/project_list.yaml\"\nprojects_dir = \"/home/ddev/www\"\n\n# Scale-to-zero settings\nidle_timeout = \"4h\"\nidle_check_interval = \"5m\"\n\n# Authentication\n[auth]\ndefault_policy = \"basic\"\nallowed_ips = []\ntokens = []\nbasic_auth = []\nrules = []\n`;\n\n writeFileSync(configPath, config);\n exec(\"chmod 640 /etc/trafic/config.toml\");\n exec(\"chown root:ddev /etc/trafic/config.toml\");\n\n success(\"Configuration created at /etc/trafic/config.toml\");\n info(\"Edit this file to configure authentication\");\n}\n\n/**\n * Create systemd service for the agent\n */\nexport function createSystemdService(): void {\n step(\"Create systemd service\");\n\n // Find the trafic-agent binary path\n const agentPath = exec(\"which trafic-agent\", { silent: true })?.trim() || \"/usr/bin/trafic-agent\";\n\n const serviceContent = `[Unit]\nDescription=Trafic Agent - DDEV preview environment manager\nAfter=network.target docker.service\nRequires=docker.service\n\n[Service]\nType=simple\nUser=ddev\nGroup=ddev\nExecStart=${agentPath} start --config /etc/trafic/config.toml\nRestart=always\nRestartSec=5\nStandardOutput=journal\nStandardError=journal\nSyslogIdentifier=trafic-agent\n\n# Environment\nEnvironment=NODE_ENV=production\n# Skip ddev-hostname /etc/hosts management — on a server, hostnames resolve\n# to the public IP (not localhost), which would trigger ddev-hostname on every\n# ddev start. DDEV_NONINTERACTIVE=true skips that entirely.\nEnvironment=DDEV_NONINTERACTIVE=true\n\n# Security hardening\nNoNewPrivileges=true\nProtectSystem=strict\nProtectHome=read-only\nReadWritePaths=/var/lib/trafic /home/ddev/.ddev\nPrivateTmp=true\n\n[Install]\nWantedBy=multi-user.target\n`;\n\n writeFileSync(\"/etc/systemd/system/trafic-agent.service\", serviceContent);\n exec(\"chmod 644 /etc/systemd/system/trafic-agent.service\");\n\n // Reload systemd and enable service\n exec(\"systemctl daemon-reload\");\n exec(\"systemctl enable trafic-agent\");\n exec(\"systemctl start trafic-agent\");\n\n success(\"Trafic agent service started\");\n info(\"View logs: journalctl -u trafic-agent -f\");\n}\n","import { step, success, info, exec, warn, commandExists } from \"./steps.js\";\nimport { writeFileSync, existsSync } from \"node:fs\";\n\n/**\n * Configure SSH hardening\n */\nexport function hardenSsh(allowedUsers: string[] = [\"ddev\"]): void {\n step(\"Harden SSH configuration\");\n\n const sshConfig = `# Trafic SSH hardening\n# Generated by trafic setup\n\n# Allow root login via SSH key only (no password) — required for server management\nPermitRootLogin prohibit-password\n\n# Disable password authentication (keys only)\nPasswordAuthentication no\nPubkeyAuthentication yes\n\n# Limit authentication attempts\nMaxAuthTries 3\n\n# Idle timeout (5 minutes)\nClientAliveInterval 300\nClientAliveCountMax 2\n\n# Allowed users (root kept for emergency access)\nAllowUsers root ${allowedUsers.join(\" \")}\n\n# Disable X11 forwarding\nX11Forwarding no\n\n# Disable TCP forwarding\nAllowTcpForwarding no\n\n# Use strong algorithms only\nKexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256\nCiphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com\nMACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com\n`;\n\n writeFileSync(\"/etc/ssh/sshd_config.d/trafic.conf\", sshConfig);\n exec(\"chmod 644 /etc/ssh/sshd_config.d/trafic.conf\");\n\n // Test config before restarting\n const testResult = exec(\"sshd -t 2>&1 || echo 'error'\", { silent: true });\n if (testResult?.includes(\"error\")) {\n warn(\"SSH config test failed, reverting...\");\n exec(\"rm /etc/ssh/sshd_config.d/trafic.conf\");\n return;\n }\n\n exec(\"systemctl reload ssh || systemctl reload sshd\");\n success(\"SSH hardened: password auth disabled, root key-only login retained\");\n info(`Allowed users: root, ${allowedUsers.join(\", \")}`);\n}\n\n/**\n * Configure UFW firewall\n */\nexport function configureFirewall(): void {\n step(\"Configure firewall (UFW)\");\n\n // Install UFW if not present\n if (!commandExists(\"ufw\")) {\n exec(\"DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y ufw\", { silent: true });\n }\n\n // Reset and configure\n exec(\"ufw --force reset\", { silent: true });\n exec(\"ufw default deny incoming\");\n exec(\"ufw default allow outgoing\");\n exec(\"ufw allow 22/tcp comment 'SSH'\");\n exec(\"ufw allow 80/tcp comment 'HTTP'\");\n exec(\"ufw allow 443/tcp comment 'HTTPS'\");\n\n // Enable firewall\n exec(\"ufw --force enable\");\n\n success(\"Firewall enabled: SSH (22), HTTP (80), HTTPS (443) allowed\");\n}\n\n/**\n * Configure automatic security updates\n */\nexport function configureUnattendedUpgrades(): void {\n step(\"Configure automatic security updates\");\n\n // Install unattended-upgrades\n exec(\n \"DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y unattended-upgrades apt-listchanges\",\n { silent: true },\n );\n\n // Configure for security updates only\n const upgradesConfig = `// Trafic: Automatic security updates\nUnattended-Upgrade::Allowed-Origins {\n \"\\${distro_id}:\\${distro_codename}\";\n \"\\${distro_id}:\\${distro_codename}-security\";\n \"\\${distro_id}ESMApps:\\${distro_codename}-apps-security\";\n \"\\${distro_id}ESM:\\${distro_codename}-infra-security\";\n};\n\n// Do not automatically reboot\nUnattended-Upgrade::Automatic-Reboot \"false\";\n\n// Remove unused dependencies\nUnattended-Upgrade::Remove-Unused-Dependencies \"true\";\n\n// Email notifications (optional)\n// Unattended-Upgrade::Mail \"root\";\n`;\n\n writeFileSync(\n \"/etc/apt/apt.conf.d/50unattended-upgrades\",\n upgradesConfig,\n );\n\n // Enable automatic updates\n const autoConfig = `APT::Periodic::Update-Package-Lists \"1\";\nAPT::Periodic::Download-Upgradeable-Packages \"1\";\nAPT::Periodic::AutocleanInterval \"7\";\nAPT::Periodic::Unattended-Upgrade \"1\";\n`;\n\n writeFileSync(\"/etc/apt/apt.conf.d/20auto-upgrades\", autoConfig);\n\n // Enable the service\n exec(\"systemctl enable unattended-upgrades\");\n exec(\"systemctl start unattended-upgrades\");\n\n success(\"Automatic security updates enabled\");\n}\n\n/**\n * Configure Fail2ban\n */\nexport function configureFail2ban(): void {\n step(\"Configure Fail2ban\");\n\n // Install fail2ban\n if (!commandExists(\"fail2ban-client\")) {\n exec(\"DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y fail2ban\", { silent: true });\n }\n\n // Configure jail\n const jailConfig = `# Trafic: Fail2ban configuration\n[DEFAULT]\nbantime = 3600\nfindtime = 600\nmaxretry = 5\nbackend = auto\n\n[sshd]\nenabled = true\nport = ssh\nfilter = sshd\nlogpath = /var/log/auth.log\nmaxretry = 3\nbantime = 7200\n`;\n\n writeFileSync(\"/etc/fail2ban/jail.local\", jailConfig);\n exec(\"chmod 644 /etc/fail2ban/jail.local\");\n\n // Restart fail2ban\n exec(\"systemctl enable fail2ban\");\n exec(\"systemctl restart fail2ban\");\n\n success(\"Fail2ban enabled: SSH brute force protection active\");\n}\n\n/**\n * Configure system limits\n */\nexport function configureSystemLimits(): void {\n step(\"Configure system limits\");\n\n const limitsConfig = `# Trafic: System limits for ddev user\nddev soft nofile 65536\nddev hard nofile 65536\nddev soft nproc 4096\nddev hard nproc 4096\n`;\n\n writeFileSync(\"/etc/security/limits.d/trafic.conf\", limitsConfig);\n exec(\"chmod 644 /etc/security/limits.d/trafic.conf\");\n\n success(\"System limits configured for ddev user\");\n}\n\n/**\n * Set proper file permissions\n */\nexport function configureFilePermissions(): void {\n step(\"Configure file permissions\");\n\n // Create directories\n exec(\"mkdir -p /etc/trafic\");\n exec(\"mkdir -p /var/lib/trafic\");\n exec(\"mkdir -p /var/backups/trafic\");\n\n // Set permissions\n exec(\"chmod 755 /etc/trafic\");\n exec(\"chmod 700 /var/lib/trafic\");\n exec(\"chmod 700 /var/backups/trafic\");\n exec(\"chown root:ddev /etc/trafic\");\n exec(\"chown ddev:ddev /var/lib/trafic\");\n exec(\"chown ddev:ddev /var/backups/trafic\");\n\n // Config file (if exists)\n if (existsSync(\"/etc/trafic/config.toml\")) {\n exec(\"chmod 640 /etc/trafic/config.toml\");\n exec(\"chown root:ddev /etc/trafic/config.toml\");\n }\n\n success(\"File permissions configured\");\n}\n\n/**\n * Run all hardening steps\n */\nexport function hardenServer(sshUsers: string[] = [\"ddev\"]): void {\n hardenSsh(sshUsers);\n configureFirewall();\n configureUnattendedUpgrades();\n configureFail2ban();\n configureSystemLimits();\n configureFilePermissions();\n}\n","import { execSync } from \"node:child_process\";\nimport { existsSync, readFileSync } from \"node:fs\";\nimport type { AuditCheck } from \"./types.js\";\n\n/**\n * Run a command silently and return output\n */\nfunction execSilent(command: string): string {\n try {\n return execSync(command, { encoding: \"utf-8\", stdio: \"pipe\" }).trim();\n } catch {\n return \"\";\n }\n}\n\n/**\n * Check if a service is active\n */\nfunction isServiceActive(service: string): boolean {\n const status = execSilent(`systemctl is-active ${service}`);\n return status === \"active\";\n}\n\n/**\n * Audit SSH configuration\n */\nfunction auditSsh(): AuditCheck[] {\n const checks: AuditCheck[] = [];\n\n // Check root login\n const sshdConfig = existsSync(\"/etc/ssh/sshd_config\")\n ? readFileSync(\"/etc/ssh/sshd_config\", \"utf-8\")\n : \"\";\n const traficConfig = existsSync(\"/etc/ssh/sshd_config.d/trafic.conf\")\n ? readFileSync(\"/etc/ssh/sshd_config.d/trafic.conf\", \"utf-8\")\n : \"\";\n\n const config = sshdConfig + \"\\n\" + traficConfig;\n\n const rootLoginDisabled =\n config.includes(\"PermitRootLogin no\") ||\n config.includes(\"PermitRootLogin prohibit-password\");\n checks.push({\n name: \"SSH root login\",\n status: rootLoginDisabled ? \"pass\" : \"fail\",\n message: rootLoginDisabled\n ? \"Root login disabled\"\n : \"Root login may be enabled\",\n fix: \"Add 'PermitRootLogin no' to /etc/ssh/sshd_config.d/trafic.conf\",\n });\n\n const passwordAuthDisabled = config.includes(\"PasswordAuthentication no\");\n checks.push({\n name: \"SSH password auth\",\n status: passwordAuthDisabled ? \"pass\" : \"warn\",\n message: passwordAuthDisabled\n ? \"Password authentication disabled\"\n : \"Password authentication may be enabled\",\n fix: \"Add 'PasswordAuthentication no' to /etc/ssh/sshd_config.d/trafic.conf\",\n });\n\n return checks;\n}\n\n/**\n * Audit firewall configuration\n */\nfunction auditFirewall(): AuditCheck[] {\n const checks: AuditCheck[] = [];\n\n const ufwStatus = execSilent(\"ufw status\");\n const isActive = ufwStatus.includes(\"Status: active\");\n\n checks.push({\n name: \"Firewall (UFW)\",\n status: isActive ? \"pass\" : \"fail\",\n message: isActive ? \"UFW is active\" : \"UFW is not active\",\n fix: \"Run: ufw enable\",\n });\n\n if (isActive) {\n const allows22 = ufwStatus.includes(\"22/tcp\");\n const allows80 = ufwStatus.includes(\"80/tcp\");\n const allows443 = ufwStatus.includes(\"443/tcp\");\n\n if (allows22 && allows80 && allows443) {\n checks.push({\n name: \"Firewall ports\",\n status: \"pass\",\n message: \"Required ports (22, 80, 443) are open\",\n });\n } else {\n checks.push({\n name: \"Firewall ports\",\n status: \"warn\",\n message: \"Some required ports may be blocked\",\n fix: \"Run: ufw allow 22/tcp && ufw allow 80/tcp && ufw allow 443/tcp\",\n });\n }\n }\n\n return checks;\n}\n\n/**\n * Audit security services\n */\nfunction auditServices(): AuditCheck[] {\n const checks: AuditCheck[] = [];\n\n // Fail2ban\n const fail2banActive = isServiceActive(\"fail2ban\");\n checks.push({\n name: \"Fail2ban\",\n status: fail2banActive ? \"pass\" : \"warn\",\n message: fail2banActive ? \"Fail2ban is active\" : \"Fail2ban is not running\",\n fix: \"Run: apt install fail2ban && systemctl enable fail2ban --now\",\n });\n\n // Unattended upgrades\n const unattendedActive = isServiceActive(\"unattended-upgrades\");\n checks.push({\n name: \"Automatic updates\",\n status: unattendedActive ? \"pass\" : \"warn\",\n message: unattendedActive\n ? \"Unattended upgrades enabled\"\n : \"Automatic updates not configured\",\n fix: \"Run: apt install unattended-upgrades && dpkg-reconfigure unattended-upgrades\",\n });\n\n // Trafic agent\n const agentActive = isServiceActive(\"trafic-agent\");\n checks.push({\n name: \"Trafic agent\",\n status: agentActive ? \"pass\" : \"fail\",\n message: agentActive\n ? \"Trafic agent is running\"\n : \"Trafic agent is not running\",\n fix: \"Run: systemctl start trafic-agent\",\n });\n\n return checks;\n}\n\n/**\n * Audit Docker\n */\nfunction auditDocker(): AuditCheck[] {\n const checks: AuditCheck[] = [];\n\n // Docker running\n const dockerActive = isServiceActive(\"docker\");\n checks.push({\n name: \"Docker\",\n status: dockerActive ? \"pass\" : \"fail\",\n message: dockerActive ? \"Docker is running\" : \"Docker is not running\",\n fix: \"Run: systemctl start docker\",\n });\n\n // Dangling images\n const danglingImages = execSilent(\n \"docker images -f dangling=true -q | wc -l\",\n );\n const count = parseInt(danglingImages, 10) || 0;\n if (count > 0) {\n checks.push({\n name: \"Docker cleanup\",\n status: \"warn\",\n message: `${count} dangling Docker images`,\n fix: \"Run: docker system prune -f\",\n });\n }\n\n // Disk usage\n const diskUsage = execSilent(\"df -h / | awk 'NR==2{print $5}'\");\n const usagePercent = parseInt(diskUsage, 10) || 0;\n checks.push({\n name: \"Disk usage\",\n status: usagePercent > 90 ? \"fail\" : usagePercent > 80 ? \"warn\" : \"pass\",\n message: `Disk usage: ${diskUsage}`,\n fix: usagePercent > 80 ? \"Consider cleaning up old projects or Docker resources\" : undefined,\n });\n\n return checks;\n}\n\n/**\n * Audit file permissions\n */\nfunction auditPermissions(): AuditCheck[] {\n const checks: AuditCheck[] = [];\n\n // Config file\n if (existsSync(\"/etc/trafic/config.toml\")) {\n const stats = execSilent(\"stat -c '%a' /etc/trafic/config.toml\");\n const isSecure = stats === \"640\" || stats === \"600\";\n checks.push({\n name: \"Config permissions\",\n status: isSecure ? \"pass\" : \"warn\",\n message: isSecure\n ? \"Config file has secure permissions\"\n : `Config file permissions: ${stats} (should be 640)`,\n fix: \"Run: chmod 640 /etc/trafic/config.toml\",\n });\n }\n\n // Projects directory\n if (existsSync(\"/home/ddev/www\")) {\n const owner = execSilent(\"stat -c '%U:%G' /home/ddev/www\");\n const isCorrect = owner === \"ddev:ddev\";\n checks.push({\n name: \"Projects directory\",\n status: isCorrect ? \"pass\" : \"warn\",\n message: isCorrect\n ? \"Projects directory owned by ddev\"\n : `Projects directory owner: ${owner}`,\n fix: \"Run: chown ddev:ddev /home/ddev/www\",\n });\n }\n\n return checks;\n}\n\n/**\n * Run all audit checks\n */\nexport function runAudit(): AuditCheck[] {\n return [\n ...auditSsh(),\n ...auditFirewall(),\n ...auditServices(),\n ...auditDocker(),\n ...auditPermissions(),\n ];\n}\n\n/**\n * Print audit results\n */\nexport function printAuditResults(checks: AuditCheck[]): void {\n console.log(\"\\n\\x1b[1mSecurity Audit Results\\x1b[0m\\n\");\n\n for (const check of checks) {\n const icon =\n check.status === \"pass\"\n ? \"\\x1b[32m✓\\x1b[0m\"\n : check.status === \"warn\"\n ? \"\\x1b[33m⚠\\x1b[0m\"\n : \"\\x1b[31m✗\\x1b[0m\";\n\n console.log(`${icon} \\x1b[1m${check.name}\\x1b[0m: ${check.message}`);\n\n if (check.fix && check.status !== \"pass\") {\n console.log(` \\x1b[90m${check.fix}\\x1b[0m`);\n }\n }\n\n const passed = checks.filter((c) => c.status === \"pass\").length;\n const warnings = checks.filter((c) => c.status === \"warn\").length;\n const failed = checks.filter((c) => c.status === \"fail\").length;\n\n console.log(\n `\\n\\x1b[1mSummary:\\x1b[0m ${passed} passed, ${warnings} warnings, ${failed} failed`,\n );\n}\n","import { existsSync } from \"node:fs\";\nimport { exec } from \"../steps.js\";\nimport { addDdevAptRepo } from \"../ddev.js\";\nimport type { Migration } from \"../types.js\";\n\n/**\n * Migration 0001: Migrate DDEV from manual tarball to apt repository.\n *\n * Old installs downloaded a tarball from GitHub releases. This migration\n * removes the manually-installed binaries and reinstalls DDEV via the\n * official apt repository so future updates are handled by apt.\n *\n * Condition: skip if /etc/apt/sources.list.d/ddev.list already exists,\n * which means the apt repository is already configured.\n */\nexport const migration0001DdevAptRepo: Migration = {\n id: \"0001__ddev_apt_repo\",\n description: \"Migrate DDEV from manual tarball to apt repository\",\n\n run(): void {\n // Already using the apt repository — nothing to do\n if (existsSync(\"/etc/apt/sources.list.d/ddev.list\")) {\n return;\n }\n\n // 1. Remove manually-installed DDEV binaries\n exec(\"rm -f /usr/local/bin/ddev /usr/local/bin/ddev-hostname /usr/local/bin/mkcert\", {\n silent: true,\n });\n\n // 2. Add the official DDEV apt repository\n addDdevAptRepo();\n\n // 3. Install DDEV via apt\n exec(\"apt-get update -qq\", { silent: true });\n exec(\"DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y ddev\", {\n silent: true,\n });\n\n // 4. Re-install mkcert CA (mkcert is now bundled with DDEV via apt)\n exec(\"mkcert -install\", { silent: true });\n },\n};\n","import { existsSync } from \"node:fs\";\nimport { exec } from \"../steps.js\";\nimport type { Migration } from \"../types.js\";\n\n/**\n * Migration 0002: Install mkcert CA in the ddev user trust store.\n *\n * Previously, `mkcert -install` was called as root without overriding HOME,\n * so the CA was stored under ~root/.local/share/mkcert. DDEV runs as the\n * `ddev` user and looks for the CA in its own home directory — so it never\n * found it, reporting mkcert as not installed.\n *\n * Fix: run `mkcert -install` with HOME=/home/ddev so the CA lands in the\n * ddev user trust store, then chown the directory to ddev:ddev.\n *\n * Condition: skip if /home/ddev/.local/share/mkcert already exists,\n * which means the CA is already installed for the ddev user.\n */\nexport const migration0002MkcertDdevUser: Migration = {\n id: \"0002__mkcert_ddev_user\",\n description: \"Install mkcert CA in the ddev user trust store\",\n\n run(): void {\n // Already installed for the ddev user — nothing to do\n if (existsSync(\"/home/ddev/.local/share/mkcert\")) {\n return;\n }\n\n exec(\"HOME=/home/ddev mkcert -install\", { silent: true });\n exec(\"chown -R ddev:ddev /home/ddev/.local/share/mkcert\", { silent: true });\n },\n};\n","import { exec } from \"../steps.js\";\nimport type { Migration } from \"../types.js\";\n\n/**\n * Migration 0003: Enable router_bind_all_interfaces in DDEV global config.\n *\n * The initial setup did not set --router-bind-all-interfaces=true, which\n * caused ddev-router to bind only on 127.0.0.1. External traffic (including\n * Cloudflare proxying) could not reach the router, resulting in 521 errors.\n *\n * This migration enables the flag and restarts the DDEV router so the change\n * takes effect immediately.\n *\n * Idempotent: ddev config global is safe to re-run with the same value.\n */\nexport const migration0003DdevRouterBindAllInterfaces: Migration = {\n id: \"0003__ddev_router_bind_all_interfaces\",\n description: \"Bind ddev-router on all interfaces (fix 521 for external traffic)\",\n\n run(): void {\n exec(\"su - ddev -c 'ddev config global --router-bind-all-interfaces=true'\", { silent: true });\n exec(\"su - ddev -c 'ddev restart router'\", { silent: true });\n },\n};\n","import { existsSync, readFileSync, writeFileSync, mkdirSync } from \"node:fs\";\nimport type { Migration, MigrationState, MigrationListEntry } from \"../types.js\";\nimport { migration0001DdevAptRepo } from \"./0001__ddev_apt_repo.js\";\nimport { migration0002MkcertDdevUser } from \"./0002__mkcert_ddev_user.js\";\nimport { migration0003DdevRouterBindAllInterfaces } from \"./0003__ddev_router_bind_all_interfaces.js\";\n\n/** Path to the persisted migration state file */\nexport const MIGRATIONS_STATE_FILE = \"/etc/trafic/.migrations.json\";\n\n/** Ordered registry of all known migrations */\nexport const ALL_MIGRATIONS: Migration[] = [\n migration0001DdevAptRepo,\n migration0002MkcertDdevUser,\n migration0003DdevRouterBindAllInterfaces,\n];\n\n// ---------------------------------------------------------------------------\n// State helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Load the current migration state from disk.\n * Returns an empty state if the file does not exist yet.\n */\nexport function loadMigrationState(): MigrationState {\n if (!existsSync(MIGRATIONS_STATE_FILE)) {\n return { applied: [] };\n }\n\n try {\n const raw = readFileSync(MIGRATIONS_STATE_FILE, \"utf-8\");\n const parsed = JSON.parse(raw) as unknown;\n if (\n parsed !== null &&\n typeof parsed === \"object\" &&\n \"applied\" in parsed &&\n Array.isArray((parsed as { applied: unknown }).applied)\n ) {\n return parsed as MigrationState;\n }\n } catch {\n // Corrupted file — start fresh\n }\n\n return { applied: [] };\n}\n\n/**\n * Persist the migration state to disk.\n * Creates /etc/trafic/ if it does not exist.\n */\nexport function saveMigrationState(state: MigrationState): void {\n mkdirSync(\"/etc/trafic\", { recursive: true });\n writeFileSync(MIGRATIONS_STATE_FILE, JSON.stringify(state, null, 2) + \"\\n\", \"utf-8\");\n}\n\n// ---------------------------------------------------------------------------\n// Public API\n// ---------------------------------------------------------------------------\n\n/**\n * Return all migrations with their current status.\n */\nexport function listMigrations(): MigrationListEntry[] {\n const state = loadMigrationState();\n return ALL_MIGRATIONS.map((migration) => ({\n migration,\n status: state.applied.includes(migration.id) ? \"applied\" : \"pending\",\n }));\n}\n\n/**\n * Run all pending migrations and persist state after each one.\n *\n * When `dryRun` is true the runner prints what it would do without\n * executing anything or touching the state file.\n */\nexport function runPendingMigrations(dryRun = false): void {\n const state = loadMigrationState();\n const pending = ALL_MIGRATIONS.filter((m) => !state.applied.includes(m.id));\n\n if (pending.length === 0) {\n console.log(\" No pending migrations.\");\n return;\n }\n\n for (const migration of pending) {\n console.log(`\\n → \\x1b[1m${migration.id}\\x1b[0m ${migration.description}`);\n\n if (dryRun) {\n console.log(` \\x1b[90m(dry-run: skipped)\\x1b[0m`);\n continue;\n }\n\n migration.run();\n\n // Persist state immediately so a partial failure leaves a consistent state\n state.applied.push(migration.id);\n saveMigrationState(state);\n\n console.log(` \\x1b[32m✓ Applied\\x1b[0m`);\n }\n}\n\n/**\n * Mark all known migrations as applied without running them.\n *\n * Called at the end of a fresh `setup()` run: a brand-new server has\n * already been configured correctly, so migrations that fix older\n * installations are not needed.\n */\nexport function markAllMigrationsApplied(): void {\n const state = loadMigrationState();\n\n for (const migration of ALL_MIGRATIONS) {\n if (!state.applied.includes(migration.id)) {\n state.applied.push(migration.id);\n }\n }\n\n saveMigrationState(state);\n}\n","import type { SetupOptions } from \"./types.js\";\nimport { step, info, error, setDryRun, resetSteps, isRoot } from \"./steps.js\";\nimport { createDdevUser } from \"./user.js\";\nimport { installDocker, configureDocker, setupDockerPrune } from \"./docker.js\";\nimport { installSystemDeps, installDdev, configureDdev, configureTraefik } from \"./ddev.js\";\nimport { installNode, installAgent, createAgentConfig, createSystemdService } from \"./agent.js\";\nimport { hardenServer } from \"./hardening.js\";\nimport { runAudit, printAuditResults } from \"./audit.js\";\nimport { markAllMigrationsApplied } from \"./migrations/index.js\";\n\nexport * from \"./types.js\";\nexport * from \"./audit.js\";\n\n/**\n * Run the full server setup\n */\nexport async function setup(options: SetupOptions): Promise<void> {\n resetSteps();\n setDryRun(options.dryRun ?? false);\n\n console.log(\"\\n\\x1b[1m🚦 Trafic Server Setup\\x1b[0m\\n\");\n\n if (options.dryRun) {\n console.log(\"\\x1b[33m⚠ Dry-run mode: no changes will be made\\x1b[0m\\n\");\n }\n\n // Check root\n if (!isRoot() && !options.dryRun) {\n error(\"This command must be run as root\");\n console.log(\" Run: sudo trafic-agent setup ...\");\n process.exit(1);\n }\n\n info(`TLD: ${options.tld}`);\n if (options.email) {\n info(`Let's Encrypt email: ${options.email}`);\n }\n if (options.noHardening) {\n info(\"Hardening: disabled\");\n }\n\n try {\n // Step 1: Install system dependencies\n installSystemDeps();\n\n // Step 2: Create ddev user\n createDdevUser();\n\n // Step 3: Install Docker\n if (!options.noDocker) {\n installDocker();\n configureDocker();\n setupDockerPrune();\n } else {\n step(\"Install Docker\");\n info(\"Skipped (--no-docker)\");\n }\n\n // Step 4: Install DDEV\n if (!options.noDdev) {\n installDdev();\n configureDdev(options.tld, options.email);\n configureTraefik();\n } else {\n step(\"Install DDEV\");\n info(\"Skipped (--no-ddev)\");\n }\n\n // Step 5: Install Node.js\n installNode();\n\n // Step 6: Install and configure agent\n installAgent();\n createAgentConfig(options.tld, options.email);\n createSystemdService();\n\n // Step 7: Server hardening\n if (!options.noHardening) {\n const sshUsers = options.sshUsers ?? [\"ddev\"];\n hardenServer(sshUsers);\n } else {\n step(\"Server hardening\");\n info(\"Skipped (--no-hardening)\");\n }\n\n // Mark all migrations as applied — fresh servers are already up-to-date\n markAllMigrationsApplied();\n\n // Done\n console.log(\"\\n\\x1b[32m✓ Setup complete!\\x1b[0m\\n\");\n console.log(\"Next steps:\");\n console.log(` 1. Edit /etc/trafic/config.toml to configure authentication`);\n console.log(` 2. Add SSH public keys to /home/ddev/.ssh/authorized_keys`);\n console.log(` 3. Deploy your first project:`);\n console.log(` npx @studiometa/trafic-cli deploy --host=<this-server> --name=my-app`);\n console.log(`\\nYour projects will be available at https://<name>.${options.tld}`);\n } catch (err) {\n error(`Setup failed: ${err instanceof Error ? err.message : err}`);\n process.exit(1);\n }\n}\n\n/**\n * Run security audit\n */\nexport async function audit(): Promise<void> {\n const checks = runAudit();\n printAuditResults(checks);\n\n const failed = checks.filter((c) => c.status === \"fail\").length;\n if (failed > 0) {\n process.exit(1);\n }\n}\n"],"mappings":";;;;AAIA,IAAM,uBAAuB;CAC3B;CACA;CACA;CACD;AAED,IAAM,iBAA8B;CAClC,KAAK;CACL,MAAM;CACN,QAAQ;CACR,iBAAiB;CACjB,aAAa;CACb,aAAa;CACb,mBAAmB;CACnB,MAAM;EACJ,eAAe;EACf,YAAY,EAAE;EACd,QAAQ,EAAE;EACV,WAAW,EAAE;EACb,OAAO,EAAE;EACV;CACF;;;;AAKD,SAAgB,cAAc,UAA0B;CAEtD,MAAM,QAAQ,SAAS,MADT,oCACqB;AACnC,KAAI,CAAC,MAAO,QAAO;CAEnB,MAAM,QAAQ,SAAS,MAAM,MAAM,KAAK,GAAG;CAC3C,MAAM,UAAU,SAAS,MAAM,MAAM,KAAK,GAAG;CAC7C,MAAM,UAAU,SAAS,MAAM,MAAM,KAAK,GAAG;AAE7C,SAAQ,QAAQ,OAAO,UAAU,KAAK,WAAW;;;;;AAMnD,SAAgB,WAAW,YAAkC;CAE3D,IAAI,OAAO;AACX,KAAI,CAAC,KACH,QAAO,qBAAqB,MAAM,MAAM,WAAW,EAAE,CAAC;AAGxD,KAAI,CAAC,QAAQ,CAAC,WAAW,KAAK,EAAE;AAC9B,UAAQ,KAAK,uCAAuC;AACpD,SAAO;;CAIT,MAAM,SAAS,MADC,aAAa,MAAM,QAAQ,CACd;CAG7B,MAAM,OAAO,gBAAgB,OAAO,KAAgC;AAEpE,QAAO;EACL,KAAM,OAAO,OAAkB,eAAe;EAC9C,MAAO,OAAO,QAAmB,eAAe;EAChD,QAAS,OAAO,WAAsB,eAAe;EACrD,iBACG,OAAO,qBAAgC,eAAe;EACzD,aAAc,OAAO,gBAA2B,eAAe;EAC/D,aACG,OAAO,gBAA2B,eAAe;EACpD,mBACG,OAAO,uBACR,eAAe;EACjB;EACD;;AAGH,SAAS,gBAAgB,KAA2C;AAClE,KAAI,CAAC,IAAK,QAAO,eAAe;CAEhC,MAAM,QAAS,IAAI,SAA4C,EAAE;AAEjE,QAAO;EACL,eACG,IAAI,kBACL,eAAe,KAAK;EACtB,YACG,IAAI,eAA4B,eAAe,KAAK;EACvD,QAAS,IAAI,UAAuB,eAAe,KAAK;EACxD,WAAY,IAAI,cAA2B,eAAe,KAAK;EAC/D,OAAO,MAAM,KACV,OAAiB;GAChB,OAAO,EAAE;GACT,QAAQ,EAAE;GACV,QAAQ,EAAE;GACV,YAAY,EAAE;GACf,EACF;EACF;;;;;AAMH,SAAgB,eAAe,QAA+B;CAC5D,MAAM,SAAmB,EAAE;AAE3B,KAAI,CAAC,OAAO,IACV,QAAO,KAAK,kBAAkB;AAGhC,KAAI,OAAO,OAAO,KAAK,OAAO,OAAO,MACnC,QAAO,KAAK,mCAAmC;AAGjD,KACE,OAAO,KAAK,kBAAkB,WAC9B,OAAO,KAAK,kBAAkB,UAC9B,OAAO,KAAK,kBAAkB,WAC9B,OAAO,KAAK,kBAAkB,QAE9B,QAAO,KAAK,2EAAmE;AAGjF,QAAO;;;;;;ACpHT,SAAgB,iBAAiB,QAA2B;CAC1D,MAAM,oBAAoB,cAAc,OAAO,YAAY;CAG3D,MAAM,WAAW,gBAAgB,OAAO,gBAAgB;CAGxD,MAAM,eAAe,gBAAgB,kBAAkB;AAEvD,MAAK,MAAM,WAAW,cAAc;EAClC,MAAM,aAAa,SAAS,IAAI,QAAQ,KAAK;AAG7C,MAAI,YAAY;GACd,MAAM,gBAAgB,kBAAkB,WAAW;AAGnD,OAAI,gBAAgB,cAAc,CAChC;GAIF,MAAM,qBAAqB,iBAAiB,cAAc;AAC1D,OAAI,uBAAuB,KAAA;QACJ,KAAK,KAAK,GAAG,QAAQ,aACvB,mBAEjB;;;AAON,MADa,eAAe,QAAQ,KAAK,EAC/B,WAAW,WAAW;AAE9B,oBAAiB,QAAQ,MAAM,UAAU;AACzC;;AAGF,UAAQ,IAAI,0BAA0B,QAAQ,OAAO;AAGrD,MAFgB,YAAY,QAAQ,KAAK,EAE5B;AACX,oBAAiB,QAAQ,MAAM,UAAU;AACzC,WAAQ,IAAI,YAAY,QAAQ,OAAO;QAEvC,SAAQ,MAAM,mBAAmB,QAAQ,OAAO;;;;;;AAQtD,SAAgB,mBAAmB,QAAqC;CACtE,MAAM,aAAa,cAAc,OAAO,kBAAkB;AAE1D,SAAQ,IACN,0CAA0C,OAAO,kBAAkB,YAAY,OAAO,cACvF;AAGD,kBAAiB,OAAO;AAGxB,QAAO,kBAAkB;AACvB,mBAAiB,OAAO;IACvB,WAAW;;AC3EhB,IAAI,aAAa;AACjB,IAAI,SAAS;;;;AAKb,SAAgB,UAAU,OAAsB;AAC9C,UAAS;;;;;AAMX,SAAgB,aAAmB;AACjC,cAAa;;;;;AAMf,SAAgB,KAAK,SAAuB;AAC1C;AACA,SAAQ,IAAI,cAAc,WAAW,WAAW,UAAU;;;;;AAM5D,SAAgB,QAAQ,SAAuB;AAC7C,SAAQ,IAAI,wBAAwB,UAAU;;;;;AAMhD,SAAgB,KAAK,SAAuB;AAC1C,SAAQ,IAAI,wBAAwB,UAAU;;;;;AAMhD,SAAgB,MAAM,SAAuB;AAC3C,SAAQ,IAAI,wBAAwB,UAAU;;;;;AAMhD,SAAgB,KAAK,SAAuB;AAC1C,SAAQ,IAAI,OAAO,UAAU;;;;;AAM/B,SAAgB,KAAK,SAAiB,SAAwC;AAC5E,KAAI,QAAQ;AACV,MAAI,CAAC,SAAS,OACZ,SAAQ,IAAI,iBAAiB,QAAQ,SAAS;AAEhD,SAAO;;AAGT,KAAI;AACF,SAAO,SAAS,SAAS;GACvB,UAAU;GACV,OAAO,SAAS,SAAS,SAAS;GACnC,CAAC;UACK,KAAK;EACZ,MAAM,IAAI;AACV,QAAM,IAAI,MAAM,mBAAmB,QAAQ,IAAI,EAAE,UAAU,KAAK;;;;;;AAOpE,SAAgB,aAAW,SAAyB;AAClD,KAAI,OACF,QAAO;AAGT,KAAI;AACF,SAAO,SAAS,SAAS;GACvB,UAAU;GACV,OAAO;GACR,CAAC,CAAC,MAAM;SACH;AACN,SAAO;;;;;;AAOX,SAAgB,cAAc,SAA0B;AACtD,KAAI;AACF,WAAS,SAAS,WAAW,EAAE,OAAO,QAAQ,CAAC;AAC/C,SAAO;SACD;AACN,SAAO;;;;;;AAOX,SAAgB,SAAkB;AAChC,QAAO,QAAQ,UAAU,KAAK;;;;;AC3GhC,SAAgB,iBAAuB;AACrC,MAAK,mBAAmB;AAIxB,KADmB,aAAW,yBAAyB,CAErD,MAAK,6BAA6B;MAC7B;AACL,OAAK,+BAA+B;AACpC,UAAQ,sBAAsB;;AAIhC,MAAK,+CAA+C,EAAE,QAAQ,MAAM,CAAC;AAGrE,MAAK,0BAA0B;AAC/B,MAAK,iCAAiC;AACtC,MAAK,2BAA2B;AAChC,SAAQ,yBAAyB;AAGjC,MAAK,2BAA2B;AAChC,MAAK,4BAA4B;AACjC,MAAK,kCAAkC;AAYvC,SAAQ,wDAAwD;;;;;ACnClE,SAAgB,gBAAsB;AACpC,MAAK,iBAAiB;AAEtB,KAAI,cAAc,SAAS,EAAE;AAE3B,OAAK,6BADW,KAAK,oBAAoB,EAAE,QAAQ,MAAM,CAAC,EACf,MAAM,IAAI,oBAAoB;AACzE;;AAIF,MAAK,mDAAmD;AACxD,MAAK,0DAA0D;AAC/D,MAAK,yBAAyB,EAAE,QAAQ,MAAM,CAAC;AAC/C,MAAK,wBAAwB;AAG7B,MAAK,2BAA2B,EAAE,QAAQ,MAAM,CAAC;AACjD,MAAK,0BAA0B,EAAE,QAAQ,MAAM,CAAC;AAEhD,SAAQ,+BAA+B;AAGvC,MAAK,2BAA2B,EAAE,QAAQ,MAAM,CAAC;AACjD,SAAQ,kCAAkC;;;;;AAM5C,SAAgB,kBAAwB;AACtC,MAAK,mBAAmB;CAGxB,MAAM,eAAe;EACnB,cAAc;EACd,YAAY;GACV,YAAY;GACZ,YAAY;GACb;EACD,kBAAkB;EAClB,gBAAgB;EACjB;AAED,MAAK,uBAAuB;CAE5B,MAAM,aAAa;AAGnB,KAAI,WAAW,WAAW,CACxB,KAAI;EAGF,MAAM,SAAS;GAAE,GAFA,KAAK,MAAM,aAAa,YAAY,QAAQ,CAAC;GAEhC,GAAG;GAAc;AAC/C,gBAAc,YAAY,KAAK,UAAU,QAAQ,MAAM,EAAE,CAAC;AAC1D,OAAK,qCAAqC;SACpC;AACN,OAAK,mDAAmD;AACxD;;KAGF,eAAc,YAAY,KAAK,UAAU,cAAc,MAAM,EAAE,CAAC;AAIlE,MAAK,sDAAsD;AAC3D,SAAQ,6CAA6C;;;;;AAMvD,SAAgB,mBAAyB;AACvC,MAAK,4BAA4B;AAMjC,eAAc,mCAJM;;EAIyC;AAC7D,MAAK,4CAA4C;AAEjD,SAAQ,kDAAkD;;;;;ACjF5D,SAAgB,oBAA0B;AACxC,MAAK,8BAA8B;AAEnC,MAAK,sBAAsB,EAAE,QAAQ,MAAM,CAAC;AAC5C,MAAK,sFAAsF,EAAE,QAAQ,MAAM,CAAC;AAE5G,SAAQ,iDAAiD;;;;;;AAO3D,SAAgB,iBAAuB;AACrC,MAAK,wCAAwC,EAAE,QAAQ,MAAM,CAAC;AAC9D,MACE,4GACA,EAAE,QAAQ,MAAM,CACjB;AACD,MAAK,wCAAwC,EAAE,QAAQ,MAAM,CAAC;AAC9D,MACE,yIACA,EAAE,QAAQ,MAAM,CACjB;;;;;AAMH,SAAgB,cAAoB;AAClC,MAAK,eAAe;AAEpB,KAAI,cAAc,OAAO,EAAE;AAEzB,OAAK,2BADW,KAAK,wCAAwC,EAAE,QAAQ,MAAM,CAAC,EACrC,MAAM,IAAI,oBAAoB;AACvE;;AAKF,MAAK,gCAAgC;AACrC,iBAAgB;AAEhB,MAAK,qBAAqB;AAC1B,MAAK,sBAAsB,EAAE,QAAQ,MAAM,CAAC;AAC5C,MAAK,6EAA6E,EAAE,QAAQ,MAAM,CAAC;AAMnG,MAAK,mCAAmC,EAAE,QAAQ,MAAM,CAAC;AACzD,MAAK,qDAAqD,EAAE,QAAQ,MAAM,CAAC;AAG3E,SAAQ,mBADQ,KAAK,wCAAwC,EAAE,QAAQ,MAAM,CAAC,EAC1C,MAAM,IAAI,oBAAoB;;;;;;;;;;;;;AAcpE,SAAgB,cAAc,KAAa,OAAsB;AAC/D,MAAK,iBAAiB;CAGtB,MAAM,WAAW,QAAgB,iBAAiB,IAAI;AAGtD,MACE,QACE,oCAAoC,IAAI,qGAAqG,QAAQ,SAAS,QAAQ,GAAG,QAAQ,uBAAuB,UAAU,GAAG,iCACtN,EACD,EAAE,QAAQ,MAAM,CACjB;AAED,SAAQ,6BAA6B,MAAM;AAC3C,MAAK,+BAA+B,IAAI,cAAc;AAEtD,KAAI,MACF,SAAQ,qCAAqC,QAAQ;AAGvD,SAAQ,kCAAkC;;;;;AAmD5C,SAAgB,mBAAyB;AACvC,MAAK,qCAAqC;AAG1C,MAAK,qCAAqC,EAAE,QAAQ,MAAM,CAAC;AAC3D,MAAK,uCAAuC,EAAE,QAAQ,MAAM,CAAC;AA2B7D,eAAc,wCAxBO;;;;;;;;;;;;;;;;;;;;;;EAwB8C;AACnE,MAAK,wDAAwD,EAAE,QAAQ,MAAM,CAAC;AAgB9E,eAAc,yCAbO;;;;;;;;;;;EAa+C;AACpE,MAAK,yDAAyD,EAAE,QAAQ,MAAM,CAAC;AAE/E,SAAQ,4CAA4C;;;;;ACjMtD,SAAgB,cAAoB;AAClC,MAAK,kBAAkB;AAGvB,KAAI,cAAc,OAAO,EAAE;AAEzB,OAAK,8BADW,KAAK,kBAAkB,EAAE,QAAQ,MAAM,CAAC,EACZ,MAAM,GAAG;AACrD;;AAIF,MACE,iGACD;AASD,eAAc,yBANS;;;;EAM+B;AACtD,MAAK,kCAAkC;AAGvC,MAAK,qDAAqD;AAC1D,MAAK,qDAAqD;AAG1D,MACE,uEACD;AACD,MAAK,qEAAqE;AAC1E,MAAK,qEAAqE;AAE1E,SAAQ,+BAA+B;;;;;AAMzC,SAAgB,eAAqB;AACnC,MAAK,uBAAuB;AAG5B,MAAK,0CAA0C;AAE/C,SAAQ,yBAAyB;;;;;AAMnC,SAAgB,kBAAkB,KAAa,QAAuB;AACpE,MAAK,6BAA6B;AAGlC,MAAK,uBAAuB;AAC5B,MAAK,2BAA2B;AAChC,MAAK,kCAAkC;CAEvC,MAAM,aAAa;AAEnB,KAAI,WAAW,WAAW,EAAE;AAC1B,OAAK,qEAAqE;AAC1E,OAAK,6CAA6C;AAClD;;AA8BF,eAAc,YA3BC;;;;SAIR,IAAI;;;;;;;;;;;;;;;;;;;;;EAuBsB;AACjC,MAAK,oCAAoC;AACzC,MAAK,0CAA0C;AAE/C,SAAQ,mDAAmD;AAC3D,MAAK,6CAA6C;;;;;AAMpD,SAAgB,uBAA6B;AAC3C,MAAK,yBAAyB;AAuC9B,eAAc,4CAlCS;;;;;;;;;YAFL,KAAK,sBAAsB,EAAE,QAAQ,MAAM,CAAC,EAAE,MAAM,IAAI,wBAWtD;;;;;;;;;;;;;;;;;;;;;;;EAyBqD;AACzE,MAAK,qDAAqD;AAG1D,MAAK,0BAA0B;AAC/B,MAAK,gCAAgC;AACrC,MAAK,+BAA+B;AAEpC,SAAQ,+BAA+B;AACvC,MAAK,2CAA2C;;;;;AC7JlD,SAAgB,UAAU,eAAyB,CAAC,OAAO,EAAQ;AACjE,MAAK,2BAA2B;AAkChC,eAAc,sCAhCI;;;;;;;;;;;;;;;;;;kBAkBF,aAAa,KAAK,IAAI,CAAC;;;;;;;;;;;;EAcuB;AAC9D,MAAK,+CAA+C;AAIpD,KADmB,KAAK,gCAAgC,EAAE,QAAQ,MAAM,CAAC,EACzD,SAAS,QAAQ,EAAE;AACjC,OAAK,uCAAuC;AAC5C,OAAK,wCAAwC;AAC7C;;AAGF,MAAK,gDAAgD;AACrD,SAAQ,qEAAqE;AAC7E,MAAK,wBAAwB,aAAa,KAAK,KAAK,GAAG;;;;;AAMzD,SAAgB,oBAA0B;AACxC,MAAK,2BAA2B;AAGhC,KAAI,CAAC,cAAc,MAAM,CACvB,MAAK,4EAA4E,EAAE,QAAQ,MAAM,CAAC;AAIpG,MAAK,qBAAqB,EAAE,QAAQ,MAAM,CAAC;AAC3C,MAAK,4BAA4B;AACjC,MAAK,6BAA6B;AAClC,MAAK,iCAAiC;AACtC,MAAK,kCAAkC;AACvC,MAAK,oCAAoC;AAGzC,MAAK,qBAAqB;AAE1B,SAAQ,6DAA6D;;;;;AAMvE,SAAgB,8BAAoC;AAClD,MAAK,uCAAuC;AAG5C,MACE,4GACA,EAAE,QAAQ,MAAM,CACjB;AAqBD,eACE,6CAnBqB;;;;;;;;;;;;;;;;EAqBtB;AASD,eAAc,uCANK;;;;EAM6C;AAGhE,MAAK,uCAAuC;AAC5C,MAAK,sCAAsC;AAE3C,SAAQ,qCAAqC;;;;;AAM/C,SAAgB,oBAA0B;AACxC,MAAK,qBAAqB;AAG1B,KAAI,CAAC,cAAc,kBAAkB,CACnC,MAAK,iFAAiF,EAAE,QAAQ,MAAM,CAAC;AAoBzG,eAAc,4BAhBK;;;;;;;;;;;;;;EAgBkC;AACrD,MAAK,qCAAqC;AAG1C,MAAK,4BAA4B;AACjC,MAAK,6BAA6B;AAElC,SAAQ,sDAAsD;;;;;AAMhE,SAAgB,wBAA8B;AAC5C,MAAK,0BAA0B;AAS/B,eAAc,sCAPO;;;;;EAO4C;AACjE,MAAK,+CAA+C;AAEpD,SAAQ,yCAAyC;;;;;AAMnD,SAAgB,2BAAiC;AAC/C,MAAK,6BAA6B;AAGlC,MAAK,uBAAuB;AAC5B,MAAK,2BAA2B;AAChC,MAAK,+BAA+B;AAGpC,MAAK,wBAAwB;AAC7B,MAAK,4BAA4B;AACjC,MAAK,gCAAgC;AACrC,MAAK,8BAA8B;AACnC,MAAK,kCAAkC;AACvC,MAAK,sCAAsC;AAG3C,KAAI,WAAW,0BAA0B,EAAE;AACzC,OAAK,oCAAoC;AACzC,OAAK,0CAA0C;;AAGjD,SAAQ,8BAA8B;;;;;AAMxC,SAAgB,aAAa,WAAqB,CAAC,OAAO,EAAQ;AAChE,WAAU,SAAS;AACnB,oBAAmB;AACnB,8BAA6B;AAC7B,oBAAmB;AACnB,wBAAuB;AACvB,2BAA0B;;;;;AC7N5B,SAAS,WAAW,SAAyB;AAC3C,KAAI;AACF,SAAO,SAAS,SAAS;GAAE,UAAU;GAAS,OAAO;GAAQ,CAAC,CAAC,MAAM;SAC/D;AACN,SAAO;;;;;;AAOX,SAAS,gBAAgB,SAA0B;AAEjD,QADe,WAAW,uBAAuB,UAAU,KACzC;;;;;AAMpB,SAAS,WAAyB;CAChC,MAAM,SAAuB,EAAE;CAG/B,MAAM,aAAa,WAAW,uBAAuB,GACjD,aAAa,wBAAwB,QAAQ,GAC7C;CACJ,MAAM,eAAe,WAAW,qCAAqC,GACjE,aAAa,sCAAsC,QAAQ,GAC3D;CAEJ,MAAM,SAAS,aAAa,OAAO;CAEnC,MAAM,oBACJ,OAAO,SAAS,qBAAqB,IACrC,OAAO,SAAS,oCAAoC;AACtD,QAAO,KAAK;EACV,MAAM;EACN,QAAQ,oBAAoB,SAAS;EACrC,SAAS,oBACL,wBACA;EACJ,KAAK;EACN,CAAC;CAEF,MAAM,uBAAuB,OAAO,SAAS,4BAA4B;AACzE,QAAO,KAAK;EACV,MAAM;EACN,QAAQ,uBAAuB,SAAS;EACxC,SAAS,uBACL,qCACA;EACJ,KAAK;EACN,CAAC;AAEF,QAAO;;;;;AAMT,SAAS,gBAA8B;CACrC,MAAM,SAAuB,EAAE;CAE/B,MAAM,YAAY,WAAW,aAAa;CAC1C,MAAM,WAAW,UAAU,SAAS,iBAAiB;AAErD,QAAO,KAAK;EACV,MAAM;EACN,QAAQ,WAAW,SAAS;EAC5B,SAAS,WAAW,kBAAkB;EACtC,KAAK;EACN,CAAC;AAEF,KAAI,UAAU;EACZ,MAAM,WAAW,UAAU,SAAS,SAAS;EAC7C,MAAM,WAAW,UAAU,SAAS,SAAS;EAC7C,MAAM,YAAY,UAAU,SAAS,UAAU;AAE/C,MAAI,YAAY,YAAY,UAC1B,QAAO,KAAK;GACV,MAAM;GACN,QAAQ;GACR,SAAS;GACV,CAAC;MAEF,QAAO,KAAK;GACV,MAAM;GACN,QAAQ;GACR,SAAS;GACT,KAAK;GACN,CAAC;;AAIN,QAAO;;;;;AAMT,SAAS,gBAA8B;CACrC,MAAM,SAAuB,EAAE;CAG/B,MAAM,iBAAiB,gBAAgB,WAAW;AAClD,QAAO,KAAK;EACV,MAAM;EACN,QAAQ,iBAAiB,SAAS;EAClC,SAAS,iBAAiB,uBAAuB;EACjD,KAAK;EACN,CAAC;CAGF,MAAM,mBAAmB,gBAAgB,sBAAsB;AAC/D,QAAO,KAAK;EACV,MAAM;EACN,QAAQ,mBAAmB,SAAS;EACpC,SAAS,mBACL,gCACA;EACJ,KAAK;EACN,CAAC;CAGF,MAAM,cAAc,gBAAgB,eAAe;AACnD,QAAO,KAAK;EACV,MAAM;EACN,QAAQ,cAAc,SAAS;EAC/B,SAAS,cACL,4BACA;EACJ,KAAK;EACN,CAAC;AAEF,QAAO;;;;;AAMT,SAAS,cAA4B;CACnC,MAAM,SAAuB,EAAE;CAG/B,MAAM,eAAe,gBAAgB,SAAS;AAC9C,QAAO,KAAK;EACV,MAAM;EACN,QAAQ,eAAe,SAAS;EAChC,SAAS,eAAe,sBAAsB;EAC9C,KAAK;EACN,CAAC;CAGF,MAAM,iBAAiB,WACrB,4CACD;CACD,MAAM,QAAQ,SAAS,gBAAgB,GAAG,IAAI;AAC9C,KAAI,QAAQ,EACV,QAAO,KAAK;EACV,MAAM;EACN,QAAQ;EACR,SAAS,GAAG,MAAM;EAClB,KAAK;EACN,CAAC;CAIJ,MAAM,YAAY,WAAW,kCAAkC;CAC/D,MAAM,eAAe,SAAS,WAAW,GAAG,IAAI;AAChD,QAAO,KAAK;EACV,MAAM;EACN,QAAQ,eAAe,KAAK,SAAS,eAAe,KAAK,SAAS;EAClE,SAAS,eAAe;EACxB,KAAK,eAAe,KAAK,0DAA0D,KAAA;EACpF,CAAC;AAEF,QAAO;;;;;AAMT,SAAS,mBAAiC;CACxC,MAAM,SAAuB,EAAE;AAG/B,KAAI,WAAW,0BAA0B,EAAE;EACzC,MAAM,QAAQ,WAAW,uCAAuC;EAChE,MAAM,WAAW,UAAU,SAAS,UAAU;AAC9C,SAAO,KAAK;GACV,MAAM;GACN,QAAQ,WAAW,SAAS;GAC5B,SAAS,WACL,uCACA,4BAA4B,MAAM;GACtC,KAAK;GACN,CAAC;;AAIJ,KAAI,WAAW,iBAAiB,EAAE;EAChC,MAAM,QAAQ,WAAW,iCAAiC;EAC1D,MAAM,YAAY,UAAU;AAC5B,SAAO,KAAK;GACV,MAAM;GACN,QAAQ,YAAY,SAAS;GAC7B,SAAS,YACL,qCACA,6BAA6B;GACjC,KAAK;GACN,CAAC;;AAGJ,QAAO;;;;;AAMT,SAAgB,WAAyB;AACvC,QAAO;EACL,GAAG,UAAU;EACb,GAAG,eAAe;EAClB,GAAG,eAAe;EAClB,GAAG,aAAa;EAChB,GAAG,kBAAkB;EACtB;;;;;AAMH,SAAgB,kBAAkB,QAA4B;AAC5D,SAAQ,IAAI,2CAA2C;AAEvD,MAAK,MAAM,SAAS,QAAQ;EAC1B,MAAM,OACJ,MAAM,WAAW,SACb,qBACA,MAAM,WAAW,SACf,qBACA;AAER,UAAQ,IAAI,GAAG,KAAK,UAAU,MAAM,KAAK,WAAW,MAAM,UAAU;AAEpE,MAAI,MAAM,OAAO,MAAM,WAAW,OAChC,SAAQ,IAAI,aAAa,MAAM,IAAI,SAAS;;CAIhD,MAAM,SAAS,OAAO,QAAQ,MAAM,EAAE,WAAW,OAAO,CAAC;CACzD,MAAM,WAAW,OAAO,QAAQ,MAAM,EAAE,WAAW,OAAO,CAAC;CAC3D,MAAM,SAAS,OAAO,QAAQ,MAAM,EAAE,WAAW,OAAO,CAAC;AAEzD,SAAQ,IACN,4BAA4B,OAAO,WAAW,SAAS,aAAa,OAAO,SAC5E;;;;;;;;;;;;ACxPH,MAAa,2BAAsC;CACjD,IAAI;CACJ,aAAa;CAEb,MAAY;AAEV,MAAI,WAAW,oCAAoC,CACjD;AAIF,OAAK,gFAAgF,EACnF,QAAQ,MACT,CAAC;AAGF,kBAAgB;AAGhB,OAAK,sBAAsB,EAAE,QAAQ,MAAM,CAAC;AAC5C,OAAK,6EAA6E,EAChF,QAAQ,MACT,CAAC;AAGF,OAAK,mBAAmB,EAAE,QAAQ,MAAM,CAAC;;CAE5C;;;;;;;;;;;;;;;ACxBD,MAAa,8BAAyC;CACpD,IAAI;CACJ,aAAa;CAEb,MAAY;AAEV,MAAI,WAAW,iCAAiC,CAC9C;AAGF,OAAK,mCAAmC,EAAE,QAAQ,MAAM,CAAC;AACzD,OAAK,qDAAqD,EAAE,QAAQ,MAAM,CAAC;;CAE9E;;;;;;;;;;;;;AChBD,MAAa,2CAAsD;CACjE,IAAI;CACJ,aAAa;CAEb,MAAY;AACV,OAAK,uEAAuE,EAAE,QAAQ,MAAM,CAAC;AAC7F,OAAK,sCAAsC,EAAE,QAAQ,MAAM,CAAC;;CAE/D;;AChBD,MAAa,wBAAwB;;AAGrC,MAAa,iBAA8B;CACzC;CACA;CACA;CACD;;;;;AAUD,SAAgB,qBAAqC;AACnD,KAAI,CAAC,WAAA,+BAAiC,CACpC,QAAO,EAAE,SAAS,EAAE,EAAE;AAGxB,KAAI;EACF,MAAM,MAAM,aAAa,uBAAuB,QAAQ;EACxD,MAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,MACE,WAAW,QACX,OAAO,WAAW,YAClB,aAAa,UACb,MAAM,QAAS,OAAgC,QAAQ,CAEvD,QAAO;SAEH;AAIR,QAAO,EAAE,SAAS,EAAE,EAAE;;;;;;AAOxB,SAAgB,mBAAmB,OAA6B;AAC9D,WAAU,eAAe,EAAE,WAAW,MAAM,CAAC;AAC7C,eAAc,uBAAuB,KAAK,UAAU,OAAO,MAAM,EAAE,GAAG,MAAM,QAAQ;;;;;AAUtF,SAAgB,iBAAuC;CACrD,MAAM,QAAQ,oBAAoB;AAClC,QAAO,eAAe,KAAK,eAAe;EACxC;EACA,QAAQ,MAAM,QAAQ,SAAS,UAAU,GAAG,GAAG,YAAY;EAC5D,EAAE;;;;;;;;AASL,SAAgB,qBAAqB,SAAS,OAAa;CACzD,MAAM,QAAQ,oBAAoB;CAClC,MAAM,UAAU,eAAe,QAAQ,MAAM,CAAC,MAAM,QAAQ,SAAS,EAAE,GAAG,CAAC;AAE3E,KAAI,QAAQ,WAAW,GAAG;AACxB,UAAQ,IAAI,2BAA2B;AACvC;;AAGF,MAAK,MAAM,aAAa,SAAS;AAC/B,UAAQ,IAAI,gBAAgB,UAAU,GAAG,WAAW,UAAU,cAAc;AAE5E,MAAI,QAAQ;AACV,WAAQ,IAAI,wCAAwC;AACpD;;AAGF,YAAU,KAAK;AAGf,QAAM,QAAQ,KAAK,UAAU,GAAG;AAChC,qBAAmB,MAAM;AAEzB,UAAQ,IAAI,+BAA+B;;;;;;;;;;AAW/C,SAAgB,2BAAiC;CAC/C,MAAM,QAAQ,oBAAoB;AAElC,MAAK,MAAM,aAAa,eACtB,KAAI,CAAC,MAAM,QAAQ,SAAS,UAAU,GAAG,CACvC,OAAM,QAAQ,KAAK,UAAU,GAAG;AAIpC,oBAAmB,MAAM;;;;;ACxG3B,eAAsB,MAAM,SAAsC;AAChE,aAAY;AACZ,WAAU,QAAQ,UAAU,MAAM;AAElC,SAAQ,IAAI,2CAA2C;AAEvD,KAAI,QAAQ,OACV,SAAQ,IAAI,2DAA2D;AAIzE,KAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,QAAQ;AAChC,QAAM,mCAAmC;AACzC,UAAQ,IAAI,qCAAqC;AACjD,UAAQ,KAAK,EAAE;;AAGjB,MAAK,QAAQ,QAAQ,MAAM;AAC3B,KAAI,QAAQ,MACV,MAAK,wBAAwB,QAAQ,QAAQ;AAE/C,KAAI,QAAQ,YACV,MAAK,sBAAsB;AAG7B,KAAI;AAEF,qBAAmB;AAGnB,kBAAgB;AAGhB,MAAI,CAAC,QAAQ,UAAU;AACrB,kBAAe;AACf,oBAAiB;AACjB,qBAAkB;SACb;AACL,QAAK,iBAAiB;AACtB,QAAK,wBAAwB;;AAI/B,MAAI,CAAC,QAAQ,QAAQ;AACnB,gBAAa;AACb,iBAAc,QAAQ,KAAK,QAAQ,MAAM;AACzC,qBAAkB;SACb;AACL,QAAK,eAAe;AACpB,QAAK,sBAAsB;;AAI7B,eAAa;AAGb,gBAAc;AACd,oBAAkB,QAAQ,KAAK,QAAQ,MAAM;AAC7C,wBAAsB;AAGtB,MAAI,CAAC,QAAQ,YAEX,cADiB,QAAQ,YAAY,CAAC,OAAO,CACvB;OACjB;AACL,QAAK,mBAAmB;AACxB,QAAK,2BAA2B;;AAIlC,4BAA0B;AAG1B,UAAQ,IAAI,uCAAuC;AACnD,UAAQ,IAAI,cAAc;AAC1B,UAAQ,IAAI,gEAAgE;AAC5E,UAAQ,IAAI,8DAA8D;AAC1E,UAAQ,IAAI,kCAAkC;AAC9C,UAAQ,IAAI,4EAA4E;AACxF,UAAQ,IAAI,uDAAuD,QAAQ,MAAM;UAC1E,KAAK;AACZ,QAAM,iBAAiB,eAAe,QAAQ,IAAI,UAAU,MAAM;AAClE,UAAQ,KAAK,EAAE;;;;;;AAOnB,eAAsB,QAAuB;CAC3C,MAAM,SAAS,UAAU;AACzB,mBAAkB,OAAO;AAGzB,KADe,OAAO,QAAQ,MAAM,EAAE,WAAW,OAAO,CAAC,SAC5C,EACX,SAAQ,KAAK,EAAE"}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@studiometa/trafic-agent",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "description": "Server agent for DDEV preview environments — auth, scale-to-zero, auto-start",
   "keywords": [
     "agent",

package/dist/setup-DGwXLdk_.js.map DELETED Viewed

@@ -1 +0,0 @@

- {"version":3,"file":"setup-DGwXLdk_.js","names":[],"sources":["../src/utils/config.ts","../src/tasks/stop-idle.ts","../src/setup/steps.ts","../src/setup/user.ts","../src/setup/docker.ts","../src/setup/ddev.ts","../src/setup/agent.ts","../src/setup/hardening.ts","../src/setup/audit.ts","../src/setup/migrations/0001__ddev_apt_repo.ts","../src/setup/migrations/0002__mkcert_ddev_user.ts","../src/setup/migrations/index.ts","../src/setup/index.ts"],"sourcesContent":["import { readFileSync, existsSync } from \"node:fs\";\nimport { parse } from \"smol-toml\";\nimport type { AgentConfig, AuthConfig, AuthRule } from \"../types.js\";\n\nconst DEFAULT_CONFIG_PATHS = [\n \"/etc/trafic/config.toml\",\n \"./config.toml\",\n \"./trafic.toml\",\n];\n\nconst DEFAULT_CONFIG: AgentConfig = {\n tld: \"\",\n port: 9876,\n dbPath: \"/var/lib/trafic/db.sqlite\",\n projectListPath: \"/home/ddev/.ddev/project_list.yaml\",\n projectsDir: \"/home/ddev/www\",\n idleTimeout: \"30m\",\n idleCheckInterval: \"5m\",\n auth: {\n defaultPolicy: \"basic\",\n allowedIps: [],\n tokens: [],\n basicAuth: [],\n rules: [],\n },\n};\n\n/**\n * Parse a duration string (e.g., \"30m\", \"1h\", \"2h30m\") to milliseconds\n */\nexport function parseDuration(duration: string): number {\n const regex = /(?:(\\d+)h)?(?:(\\d+)m)?(?:(\\d+)s)?/;\n const match = duration.match(regex);\n if (!match) return 0;\n\n const hours = parseInt(match[1] ?? \"0\", 10);\n const minutes = parseInt(match[2] ?? \"0\", 10);\n const seconds = parseInt(match[3] ?? \"0\", 10);\n\n return (hours * 3600 + minutes * 60 + seconds) * 1000;\n}\n\n/**\n * Load configuration from TOML file\n */\nexport function loadConfig(configPath?: string): AgentConfig {\n // Find config file\n let path = configPath;\n if (!path) {\n path = DEFAULT_CONFIG_PATHS.find((p) => existsSync(p));\n }\n\n if (!path || !existsSync(path)) {\n console.warn(\"No config file found, using defaults\");\n return DEFAULT_CONFIG;\n }\n\n const content = readFileSync(path, \"utf-8\");\n const parsed = parse(content) as Record<string, unknown>;\n\n // Merge with defaults\n const auth = mergeAuthConfig(parsed.auth as Record<string, unknown>);\n\n return {\n tld: (parsed.tld as string) ?? DEFAULT_CONFIG.tld,\n port: (parsed.port as number) ?? DEFAULT_CONFIG.port,\n dbPath: (parsed.db_path as string) ?? DEFAULT_CONFIG.dbPath,\n projectListPath:\n (parsed.project_list_path as string) ?? DEFAULT_CONFIG.projectListPath,\n projectsDir: (parsed.projects_dir as string) ?? DEFAULT_CONFIG.projectsDir,\n idleTimeout:\n (parsed.idle_timeout as string) ?? DEFAULT_CONFIG.idleTimeout,\n idleCheckInterval:\n (parsed.idle_check_interval as string) ??\n DEFAULT_CONFIG.idleCheckInterval,\n auth,\n };\n}\n\nfunction mergeAuthConfig(raw?: Record<string, unknown>): AuthConfig {\n if (!raw) return DEFAULT_CONFIG.auth;\n\n const rules = (raw.rules as Array<Record<string, unknown>>) ?? [];\n\n return {\n defaultPolicy:\n (raw.default_policy as AuthConfig[\"defaultPolicy\"]) ??\n DEFAULT_CONFIG.auth.defaultPolicy,\n allowedIps:\n (raw.allowed_ips as string[]) ?? DEFAULT_CONFIG.auth.allowedIps,\n tokens: (raw.tokens as string[]) ?? DEFAULT_CONFIG.auth.tokens,\n basicAuth: (raw.basic_auth as string[]) ?? DEFAULT_CONFIG.auth.basicAuth,\n rules: rules.map(\n (r): AuthRule => ({\n match: r.match as string,\n policy: r.policy as AuthRule[\"policy\"],\n tokens: r.tokens as string[] | undefined,\n allowedIps: r.allowed_ips as string[] | undefined,\n }),\n ),\n };\n}\n\n/**\n * Validate configuration\n */\nexport function validateConfig(config: AgentConfig): string[] {\n const errors: string[] = [];\n\n if (!config.tld) {\n errors.push(\"tld is required\");\n }\n\n if (config.port < 1 || config.port > 65535) {\n errors.push(\"port must be between 1 and 65535\");\n }\n\n if (\n config.auth.defaultPolicy !== \"allow\" &&\n config.auth.defaultPolicy !== \"deny\" &&\n config.auth.defaultPolicy !== \"basic\" &&\n config.auth.defaultPolicy !== \"token\"\n ) {\n errors.push('auth.default_policy must be \"allow\", \"deny\", \"basic\", or \"token\"');\n }\n\n return errors;\n}\n","import { getIdleProjects, setProjectStatus } from \"../utils/db.js\";\nimport { stopProject, getProjectInfo, loadProjectList } from \"../utils/ddev.js\";\nimport { parseDuration } from \"../utils/config.js\";\nimport { loadProjectConfig, shouldNeverStop, getIdleTimeoutMs } from \"../utils/project-config.js\";\nimport type { AgentConfig } from \"../types.js\";\n\n/**\n * Stop idle projects that haven't been accessed recently\n * Respects per-project idle_timeout settings from .ddev/config.trafic.yaml\n */\nexport function stopIdleProjects(config: AgentConfig): void {\n const globalThresholdMs = parseDuration(config.idleTimeout);\n\n // Get all projects to check their individual configs\n const projects = loadProjectList(config.projectListPath);\n\n // Get projects idle according to global threshold\n const idleProjects = getIdleProjects(globalThresholdMs);\n\n for (const project of idleProjects) {\n const projectDir = projects.get(project.name);\n\n // Load per-project config if available\n if (projectDir) {\n const projectConfig = loadProjectConfig(projectDir);\n\n // Skip if project is configured to never stop\n if (shouldNeverStop(projectConfig)) {\n continue;\n }\n\n // Check project-specific idle timeout\n const projectThresholdMs = getIdleTimeoutMs(projectConfig);\n if (projectThresholdMs !== undefined) {\n const idleDuration = Date.now() - project.lastAccess;\n if (idleDuration < projectThresholdMs) {\n // Not idle according to project-specific timeout\n continue;\n }\n }\n }\n\n // Double-check project is actually running via DDEV\n const info = getProjectInfo(project.name);\n if (info?.status !== \"running\") {\n // Already stopped, just update our record\n setProjectStatus(project.name, \"stopped\");\n continue;\n }\n\n console.log(`Stopping idle project: ${project.name}`);\n const success = stopProject(project.name);\n\n if (success) {\n setProjectStatus(project.name, \"stopped\");\n console.log(`Stopped: ${project.name}`);\n } else {\n console.error(`Failed to stop: ${project.name}`);\n }\n }\n}\n\n/**\n * Start the idle check scheduler\n */\nexport function startIdleScheduler(config: AgentConfig): NodeJS.Timeout {\n const intervalMs = parseDuration(config.idleCheckInterval);\n\n console.log(\n `Idle scheduler started: checking every ${config.idleCheckInterval}, timeout ${config.idleTimeout}`,\n );\n\n // Run immediately on start\n stopIdleProjects(config);\n\n // Then run on interval\n return setInterval(() => {\n stopIdleProjects(config);\n }, intervalMs);\n}\n","import { execSync } from \"node:child_process\";\nimport { writeFileSync as fsWriteFile } from \"node:fs\";\n\nlet stepNumber = 0;\nlet dryRun = false;\n\n/**\n * Set dry-run mode\n */\nexport function setDryRun(value: boolean): void {\n dryRun = value;\n}\n\n/**\n * Reset step counter\n */\nexport function resetSteps(): void {\n stepNumber = 0;\n}\n\n/**\n * Log a step\n */\nexport function step(message: string): void {\n stepNumber++;\n console.log(`\\n\\x1b[36m[${stepNumber}]\\x1b[0m ${message}`);\n}\n\n/**\n * Log success\n */\nexport function success(message: string): void {\n console.log(` \\x1b[32m✓\\x1b[0m ${message}`);\n}\n\n/**\n * Log warning\n */\nexport function warn(message: string): void {\n console.log(` \\x1b[33m⚠\\x1b[0m ${message}`);\n}\n\n/**\n * Log error\n */\nexport function error(message: string): void {\n console.log(` \\x1b[31m✗\\x1b[0m ${message}`);\n}\n\n/**\n * Log info\n */\nexport function info(message: string): void {\n console.log(` ${message}`);\n}\n\n/**\n * Execute a command (or show in dry-run mode)\n */\nexport function exec(command: string, options?: { silent?: boolean }): string {\n if (dryRun) {\n if (!options?.silent) {\n console.log(` \\x1b[90m$ ${command}\\x1b[0m`);\n }\n return \"\";\n }\n\n try {\n return execSync(command, {\n encoding: \"utf-8\",\n stdio: options?.silent ? \"pipe\" : \"inherit\",\n });\n } catch (err) {\n const e = err as { status?: number; stderr?: string };\n throw new Error(`Command failed: ${command}\\n${e.stderr ?? \"\"}`);\n }\n}\n\n/**\n * Execute a command and return output (silent)\n */\nexport function execSilent(command: string): string {\n if (dryRun) {\n return \"\";\n }\n\n try {\n return execSync(command, {\n encoding: \"utf-8\",\n stdio: \"pipe\",\n }).trim();\n } catch {\n return \"\";\n }\n}\n\n/**\n * Check if a command exists\n */\nexport function commandExists(command: string): boolean {\n try {\n execSync(`which ${command}`, { stdio: \"pipe\" });\n return true;\n } catch {\n return false;\n }\n}\n\n/**\n * Check if running as root\n */\nexport function isRoot(): boolean {\n return process.getuid?.() === 0;\n}\n\n/**\n * Write a file (or show in dry-run mode)\n */\nexport function writeFile(path: string, content: string): void {\n if (dryRun) {\n console.log(` \\x1b[90mWrite ${path}:\\x1b[0m`);\n const lines = content.split(\"\\n\").slice(0, 5);\n for (const line of lines) {\n console.log(` \\x1b[90m ${line}\\x1b[0m`);\n }\n if (content.split(\"\\n\").length > 5) {\n console.log(` \\x1b[90m ...\\x1b[0m`);\n }\n return;\n }\n\n fsWriteFile(path, content);\n}\n","import { step, success, info, exec, execSilent, warn } from \"./steps.js\";\n\n/**\n * Create the ddev user with proper permissions\n */\nexport function createDdevUser(): void {\n step(\"Create ddev user\");\n\n // Check if user exists\n const userExists = execSilent(\"id -u ddev 2>/dev/null\");\n if (userExists) {\n info(\"User 'ddev' already exists\");\n } else {\n exec(\"useradd -m -s /bin/bash ddev\");\n success(\"Created user 'ddev'\");\n }\n\n // Add to docker group (will be created by Docker install)\n exec(\"usermod -aG docker ddev 2>/dev/null || true\", { silent: true });\n\n // Create www directory\n exec(\"mkdir -p /home/ddev/www\");\n exec(\"chown ddev:ddev /home/ddev/www\");\n exec(\"chmod 750 /home/ddev/www\");\n success(\"Created /home/ddev/www\");\n\n // Create .ssh directory if needed\n exec(\"mkdir -p /home/ddev/.ssh\");\n exec(\"chmod 700 /home/ddev/.ssh\");\n exec(\"chown ddev:ddev /home/ddev/.ssh\");\n\n // Note: ddev user doesn't need sudo when DNS is properly configured\n // - Docker access: via docker group membership\n // - DDEV: runs as regular user, no sudo needed\n // - Agent: runs as systemd service (root manages it)\n // - Hostname resolution: via DNS (*.tld → server IP), not /etc/hosts\n //\n // If DNS is NOT configured for the custom TLD, DDEV will try to edit\n // /etc/hosts which requires sudo. In that case, you'd need:\n // echo \"ddev ALL=(ALL) NOPASSWD: /usr/local/bin/ddev-hostname\" >> /etc/sudoers.d/ddev\n // But it's better to just configure DNS properly.\n success(\"User ddev configured (no sudo needed with proper DNS)\");\n}\n\n/**\n * Setup authorized_keys for ddev user\n */\nexport function setupAuthorizedKeys(publicKey?: string): void {\n if (!publicKey) {\n warn(\"No SSH public key provided, skipping authorized_keys setup\");\n return;\n }\n\n step(\"Setup SSH authorized_keys\");\n\n const authKeysPath = \"/home/ddev/.ssh/authorized_keys\";\n exec(`touch ${authKeysPath}`);\n exec(`chmod 600 ${authKeysPath}`);\n exec(`chown ddev:ddev ${authKeysPath}`);\n\n // Check if key already exists\n const existing = execSilent(`cat ${authKeysPath}`);\n if (existing.includes(publicKey.trim())) {\n info(\"SSH key already authorized\");\n } else {\n exec(`echo '${publicKey}' >> ${authKeysPath}`);\n success(\"Added SSH public key\");\n }\n}\n","import { writeFileSync, existsSync, readFileSync } from \"node:fs\";\nimport { step, success, info, exec, commandExists, warn } from \"./steps.js\";\n\n/**\n * Install Docker using the official script\n */\nexport function installDocker(): void {\n step(\"Install Docker\");\n\n if (commandExists(\"docker\")) {\n const version = exec(\"docker --version\", { silent: true });\n info(`Docker already installed: ${version?.trim() ?? \"unknown version\"}`);\n return;\n }\n\n // Install Docker using official script\n info(\"Downloading and running Docker install script...\");\n exec(\"curl -fsSL https://get.docker.com -o /tmp/get-docker.sh\");\n exec(\"sh /tmp/get-docker.sh\", { silent: true });\n exec(\"rm /tmp/get-docker.sh\");\n\n // Enable and start Docker\n exec(\"systemctl enable docker\", { silent: true });\n exec(\"systemctl start docker\", { silent: true });\n\n success(\"Docker installed and started\");\n\n // Add ddev user to docker group\n exec(\"usermod -aG docker ddev\", { silent: true });\n success(\"Added ddev user to docker group\");\n}\n\n/**\n * Configure Docker for production use\n */\nexport function configureDocker(): void {\n step(\"Configure Docker\");\n\n // Create daemon.json with production settings\n const daemonConfig = {\n \"log-driver\": \"json-file\",\n \"log-opts\": {\n \"max-size\": \"10m\",\n \"max-file\": \"3\",\n },\n \"storage-driver\": \"overlay2\",\n \"live-restore\": true,\n };\n\n exec(\"mkdir -p /etc/docker\");\n\n const configPath = \"/etc/docker/daemon.json\";\n\n // Check if config already exists\n if (existsSync(configPath)) {\n try {\n const existing = JSON.parse(readFileSync(configPath, \"utf-8\"));\n // Merge with existing config\n const merged = { ...existing, ...daemonConfig };\n writeFileSync(configPath, JSON.stringify(merged, null, 2));\n info(\"Merged with existing Docker config\");\n } catch {\n warn(\"Could not parse existing Docker config, skipping\");\n return;\n }\n } else {\n writeFileSync(configPath, JSON.stringify(daemonConfig, null, 2));\n }\n\n // Reload Docker to apply config\n exec(\"systemctl reload docker || systemctl restart docker\");\n success(\"Docker configured with production settings\");\n}\n\n/**\n * Setup Docker system prune cron job\n */\nexport function setupDockerPrune(): void {\n step(\"Setup Docker cleanup cron\");\n\n const cronContent = `# Trafic: Clean up Docker resources weekly\n0 3 * * 0 root docker system prune -af --volumes 2>&1 | logger -t docker-prune\n`;\n\n writeFileSync(\"/etc/cron.d/trafic-docker-prune\", cronContent);\n exec(\"chmod 644 /etc/cron.d/trafic-docker-prune\");\n\n success(\"Docker prune scheduled weekly at 3am on Sundays\");\n}\n","import { writeFileSync } from \"node:fs\";\nimport { step, success, info, exec, commandExists } from \"./steps.js\";\n\n/**\n * Install system dependencies required by Trafic\n */\nexport function installSystemDeps(): void {\n step(\"Install system dependencies\");\n\n exec(\"apt-get update -qq\", { silent: true });\n exec(\"DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y jq curl rsync\", { silent: true });\n\n success(\"System dependencies installed: jq, curl, rsync\");\n}\n\n/**\n * Add the official DDEV apt repository and GPG key.\n * Idempotent: safe to call even if the repository is already configured.\n */\nexport function addDdevAptRepo(): void {\n exec(\"install -m 0755 -d /etc/apt/keyrings\", { silent: true });\n exec(\n \"curl -fsSL https://pkg.ddev.com/apt/gpg.key | gpg --dearmor | tee /etc/apt/keyrings/ddev.gpg > /dev/null\",\n { silent: true },\n );\n exec(\"chmod a+r /etc/apt/keyrings/ddev.gpg\", { silent: true });\n exec(\n \"echo \\\"deb [signed-by=/etc/apt/keyrings/ddev.gpg] https://pkg.ddev.com/apt/ * *\\\" | tee /etc/apt/sources.list.d/ddev.list > /dev/null\",\n { silent: true },\n );\n}\n\n/**\n * Install DDEV\n */\nexport function installDdev(): void {\n step(\"Install DDEV\");\n\n if (commandExists(\"ddev\")) {\n const version = exec(\"ddev --version 2>/dev/null | head -1\", { silent: true });\n info(`DDEV already installed: ${version?.trim() ?? \"unknown version\"}`);\n return;\n }\n\n // Install DDEV via the official apt repository\n // See https://docs.ddev.com/en/stable/users/install/ddev-installation/#debianubuntu\n info(\"Adding DDEV apt repository...\");\n addDdevAptRepo();\n\n info(\"Installing DDEV...\");\n exec(\"apt-get update -qq\", { silent: true });\n exec(\"DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y ddev\", { silent: true });\n\n // Initialize mkcert certificate authority for the ddev user.\n // mkcert installs the CA into the home directory of the current user.\n // Since setup runs as root, we must point HOME to the ddev user's home\n // so the CA is trusted by DDEV when it runs as that user.\n exec(\"HOME=/home/ddev mkcert -install\", { silent: true });\n exec(\"chown -R ddev:ddev /home/ddev/.local/share/mkcert\", { silent: true });\n\n const version = exec(\"ddev --version 2>/dev/null | head -1\", { silent: true });\n success(`DDEV installed: ${version?.trim() ?? \"unknown version\"}`);\n}\n\n/**\n * Configure DDEV global settings for production\n *\n * Note on DNS and /etc/hosts:\n * When using a custom TLD (not ddev.site), DDEV may try to edit /etc/hosts\n * if it can't resolve project hostnames via DNS. To avoid this:\n * 1. Configure DNS so *.{tld} resolves to the server's IP (recommended)\n * 2. Or install dnsmasq for local wildcard DNS resolution\n *\n * With proper DNS, DDEV won't need sudo for hostname management.\n */\nexport function configureDdev(tld: string, email?: string): void {\n step(\"Configure DDEV\");\n\n // Run as ddev user\n const ddevCmd = (cmd: string) => `su - ddev -c '${cmd}'`;\n\n // Configure all global settings in a single call\n exec(\n ddevCmd(\n `ddev config global --project-tld=${tld} --router-http-port=80 --router-https-port=443 --use-letsencrypt=${email ? \"true\" : \"false\"} ${email ? `--letsencrypt-email=${email}` : \"\"} --instrumentation-opt-in=false`,\n ),\n { silent: true },\n );\n\n success(`DDEV configured with TLD: ${tld}`);\n info(`Ensure DNS is configured: *.${tld} → server IP`);\n\n if (email) {\n success(`Let's Encrypt enabled with email: ${email}`);\n }\n\n success(\"DDEV global settings configured\");\n}\n\n/**\n * Install dnsmasq for local DNS resolution (optional)\n * This allows the server itself to resolve *.{tld} hostnames\n * without needing to edit /etc/hosts for each project\n */\nexport function installDnsmasq(tld: string): void {\n step(\"Install dnsmasq for local DNS\");\n\n exec(\"apt-get update && apt-get install -y dnsmasq\", { silent: true });\n\n // Get server's public IP\n const serverIp = exec(\n \"curl -4 -s ifconfig.me || hostname -I | awk '{print $1}'\",\n { silent: true },\n )?.trim() || \"127.0.0.1\";\n\n // Configure dnsmasq to resolve *.{tld} to server IP\n const dnsmasqConfig = `# Trafic: Local DNS for DDEV projects\n# Resolve all *.${tld} to this server\naddress=/${tld}/${serverIp}\n\n# Don't read /etc/resolv.conf\nno-resolv\n\n# Use upstream DNS for everything else\nserver=1.1.1.1\nserver=8.8.8.8\n\n# Listen on localhost only\nlisten-address=127.0.0.1\nbind-interfaces\n`;\n\n writeFileSync(\"/etc/dnsmasq.d/trafic.conf\", dnsmasqConfig);\n\n // Configure system to use local dnsmasq\n exec(\"systemctl restart dnsmasq\");\n exec(\"systemctl enable dnsmasq\");\n\n // Update resolv.conf to use local DNS first\n info(\"Configure /etc/resolv.conf to use 127.0.0.1 as primary DNS\");\n\n success(`dnsmasq configured: *.${tld} → ${serverIp}`);\n}\n\n/**\n * Configure Traefik for forward auth\n */\nexport function configureTraefik(): void {\n step(\"Configure Traefik for forward auth\");\n\n // Create custom Traefik config directory\n exec(\"mkdir -p /home/ddev/.ddev/traefik\", { silent: true });\n exec(\"chown -R ddev:ddev /home/ddev/.ddev\", { silent: true });\n\n // Static configuration for Trafic middleware\n const staticConfig = `# Trafic: Forward auth middleware\nhttp:\n middlewares:\n trafic-auth:\n forwardAuth:\n address: \"http://host.docker.internal:9876/__auth__\"\n authResponseHeaders:\n - \"X-Trafic-Project\"\n\n trafic-errors:\n errors:\n status:\n - \"502\"\n - \"503\"\n service: trafic-service\n query: \"/\"\n\n services:\n trafic-service:\n loadBalancer:\n servers:\n - url: \"http://host.docker.internal:9876\"\n`;\n\n writeFileSync(\"/home/ddev/.ddev/traefik/trafic.yaml\", staticConfig);\n exec(\"chown ddev:ddev /home/ddev/.ddev/traefik/trafic.yaml\", { silent: true });\n\n // Create default router config that applies middleware to all projects\n const routerConfig = `# Trafic: Default router configuration\n# This file makes all DDEV projects use the Trafic auth middleware\nhttp:\n routers:\n trafic-catch-all:\n rule: \"HostRegexp(\\`.+\\`)\"\n priority: 1\n middlewares:\n - trafic-auth\n - trafic-errors\n service: api@internal\n`;\n\n writeFileSync(\"/home/ddev/.ddev/traefik/dynamic.yaml\", routerConfig);\n exec(\"chown ddev:ddev /home/ddev/.ddev/traefik/dynamic.yaml\", { silent: true });\n\n success(\"Traefik configured with Trafic middleware\");\n}\n","import { step, success, info, exec, commandExists } from \"./steps.js\";\nimport { writeFileSync, existsSync } from \"node:fs\";\n\n/**\n * Install Node.js using fnm\n */\nexport function installNode(): void {\n step(\"Install Node.js\");\n\n // Check if Node is already installed\n if (commandExists(\"node\")) {\n const version = exec(\"node --version\", { silent: true });\n info(`Node.js already installed: ${version?.trim()}`);\n return;\n }\n\n // Install fnm (Fast Node Manager)\n exec(\n 'curl -fsSL https://fnm.vercel.app/install | bash -s -- --install-dir \"/opt/fnm\" --skip-shell',\n );\n\n // Add fnm to system path\n const profileContent = `# Trafic: fnm (Node.js version manager)\nexport FNM_DIR=\"/opt/fnm\"\nexport PATH=\"/opt/fnm:$PATH\"\neval \"$(fnm env)\"\n`;\n\n writeFileSync(\"/etc/profile.d/fnm.sh\", profileContent);\n exec(\"chmod 644 /etc/profile.d/fnm.sh\");\n\n // Install Node.js 24\n exec(\"export FNM_DIR=/opt/fnm && /opt/fnm/fnm install 24\");\n exec(\"export FNM_DIR=/opt/fnm && /opt/fnm/fnm default 24\");\n\n // Create symlinks for system-wide access\n exec(\n \"ln -sf /opt/fnm/aliases/default/bin/node /usr/local/bin/node || true\",\n );\n exec(\"ln -sf /opt/fnm/aliases/default/bin/npm /usr/local/bin/npm || true\");\n exec(\"ln -sf /opt/fnm/aliases/default/bin/npx /usr/local/bin/npx || true\");\n\n success(\"Node.js 24 installed via fnm\");\n}\n\n/**\n * Install the Trafic agent\n */\nexport function installAgent(): void {\n step(\"Install Trafic agent\");\n\n // Install the agent globally\n exec(\"npm install -g @studiometa/trafic-agent\");\n\n success(\"Trafic agent installed\");\n}\n\n/**\n * Create the agent configuration\n */\nexport function createAgentConfig(tld: string, _email?: string): void {\n step(\"Create agent configuration\");\n\n // Create directories\n exec(\"mkdir -p /etc/trafic\");\n exec(\"mkdir -p /var/lib/trafic\");\n exec(\"chown ddev:ddev /var/lib/trafic\");\n\n const configPath = \"/etc/trafic/config.toml\";\n\n if (existsSync(configPath)) {\n info(\"Configuration already exists at /etc/trafic/config.toml — skipping\");\n info(\"Edit this file to configure authentication\");\n return;\n }\n\n const config = `# Trafic agent configuration\n# Generated by trafic setup\n\n# Required: TLD for DDEV projects\ntld = \"${tld}\"\n\n# Agent HTTP server port\nport = 9876\n\n# Database and paths\ndb_path = \"/var/lib/trafic/db.sqlite\"\nproject_list_path = \"/home/ddev/.ddev/project_list.yaml\"\nprojects_dir = \"/home/ddev/www\"\n\n# Scale-to-zero settings\nidle_timeout = \"4h\"\nidle_check_interval = \"5m\"\n\n# Authentication\n[auth]\ndefault_policy = \"basic\"\nallowed_ips = []\ntokens = []\nbasic_auth = []\nrules = []\n`;\n\n writeFileSync(configPath, config);\n exec(\"chmod 640 /etc/trafic/config.toml\");\n exec(\"chown root:ddev /etc/trafic/config.toml\");\n\n success(\"Configuration created at /etc/trafic/config.toml\");\n info(\"Edit this file to configure authentication\");\n}\n\n/**\n * Create systemd service for the agent\n */\nexport function createSystemdService(): void {\n step(\"Create systemd service\");\n\n // Find the trafic-agent binary path\n const agentPath = exec(\"which trafic-agent\", { silent: true })?.trim() || \"/usr/bin/trafic-agent\";\n\n const serviceContent = `[Unit]\nDescription=Trafic Agent - DDEV preview environment manager\nAfter=network.target docker.service\nRequires=docker.service\n\n[Service]\nType=simple\nUser=ddev\nGroup=ddev\nExecStart=${agentPath} start --config /etc/trafic/config.toml\nRestart=always\nRestartSec=5\nStandardOutput=journal\nStandardError=journal\nSyslogIdentifier=trafic-agent\n\n# Environment\nEnvironment=NODE_ENV=production\n# Skip ddev-hostname /etc/hosts management — on a server, hostnames resolve\n# to the public IP (not localhost), which would trigger ddev-hostname on every\n# ddev start. DDEV_NONINTERACTIVE=true skips that entirely.\nEnvironment=DDEV_NONINTERACTIVE=true\n\n# Security hardening\nNoNewPrivileges=true\nProtectSystem=strict\nProtectHome=read-only\nReadWritePaths=/var/lib/trafic /home/ddev/.ddev\nPrivateTmp=true\n\n[Install]\nWantedBy=multi-user.target\n`;\n\n writeFileSync(\"/etc/systemd/system/trafic-agent.service\", serviceContent);\n exec(\"chmod 644 /etc/systemd/system/trafic-agent.service\");\n\n // Reload systemd and enable service\n exec(\"systemctl daemon-reload\");\n exec(\"systemctl enable trafic-agent\");\n exec(\"systemctl start trafic-agent\");\n\n success(\"Trafic agent service started\");\n info(\"View logs: journalctl -u trafic-agent -f\");\n}\n","import { step, success, info, exec, warn, commandExists } from \"./steps.js\";\nimport { writeFileSync, existsSync } from \"node:fs\";\n\n/**\n * Configure SSH hardening\n */\nexport function hardenSsh(allowedUsers: string[] = [\"ddev\"]): void {\n step(\"Harden SSH configuration\");\n\n const sshConfig = `# Trafic SSH hardening\n# Generated by trafic setup\n\n# Allow root login via SSH key only (no password) — required for server management\nPermitRootLogin prohibit-password\n\n# Disable password authentication (keys only)\nPasswordAuthentication no\nPubkeyAuthentication yes\n\n# Limit authentication attempts\nMaxAuthTries 3\n\n# Idle timeout (5 minutes)\nClientAliveInterval 300\nClientAliveCountMax 2\n\n# Allowed users (root kept for emergency access)\nAllowUsers root ${allowedUsers.join(\" \")}\n\n# Disable X11 forwarding\nX11Forwarding no\n\n# Disable TCP forwarding\nAllowTcpForwarding no\n\n# Use strong algorithms only\nKexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256\nCiphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com\nMACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com\n`;\n\n writeFileSync(\"/etc/ssh/sshd_config.d/trafic.conf\", sshConfig);\n exec(\"chmod 644 /etc/ssh/sshd_config.d/trafic.conf\");\n\n // Test config before restarting\n const testResult = exec(\"sshd -t 2>&1 || echo 'error'\", { silent: true });\n if (testResult?.includes(\"error\")) {\n warn(\"SSH config test failed, reverting...\");\n exec(\"rm /etc/ssh/sshd_config.d/trafic.conf\");\n return;\n }\n\n exec(\"systemctl reload ssh || systemctl reload sshd\");\n success(\"SSH hardened: password auth disabled, root key-only login retained\");\n info(`Allowed users: root, ${allowedUsers.join(\", \")}`);\n}\n\n/**\n * Configure UFW firewall\n */\nexport function configureFirewall(): void {\n step(\"Configure firewall (UFW)\");\n\n // Install UFW if not present\n if (!commandExists(\"ufw\")) {\n exec(\"DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y ufw\", { silent: true });\n }\n\n // Reset and configure\n exec(\"ufw --force reset\", { silent: true });\n exec(\"ufw default deny incoming\");\n exec(\"ufw default allow outgoing\");\n exec(\"ufw allow 22/tcp comment 'SSH'\");\n exec(\"ufw allow 80/tcp comment 'HTTP'\");\n exec(\"ufw allow 443/tcp comment 'HTTPS'\");\n\n // Enable firewall\n exec(\"ufw --force enable\");\n\n success(\"Firewall enabled: SSH (22), HTTP (80), HTTPS (443) allowed\");\n}\n\n/**\n * Configure automatic security updates\n */\nexport function configureUnattendedUpgrades(): void {\n step(\"Configure automatic security updates\");\n\n // Install unattended-upgrades\n exec(\n \"DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y unattended-upgrades apt-listchanges\",\n { silent: true },\n );\n\n // Configure for security updates only\n const upgradesConfig = `// Trafic: Automatic security updates\nUnattended-Upgrade::Allowed-Origins {\n \"\\${distro_id}:\\${distro_codename}\";\n \"\\${distro_id}:\\${distro_codename}-security\";\n \"\\${distro_id}ESMApps:\\${distro_codename}-apps-security\";\n \"\\${distro_id}ESM:\\${distro_codename}-infra-security\";\n};\n\n// Do not automatically reboot\nUnattended-Upgrade::Automatic-Reboot \"false\";\n\n// Remove unused dependencies\nUnattended-Upgrade::Remove-Unused-Dependencies \"true\";\n\n// Email notifications (optional)\n// Unattended-Upgrade::Mail \"root\";\n`;\n\n writeFileSync(\n \"/etc/apt/apt.conf.d/50unattended-upgrades\",\n upgradesConfig,\n );\n\n // Enable automatic updates\n const autoConfig = `APT::Periodic::Update-Package-Lists \"1\";\nAPT::Periodic::Download-Upgradeable-Packages \"1\";\nAPT::Periodic::AutocleanInterval \"7\";\nAPT::Periodic::Unattended-Upgrade \"1\";\n`;\n\n writeFileSync(\"/etc/apt/apt.conf.d/20auto-upgrades\", autoConfig);\n\n // Enable the service\n exec(\"systemctl enable unattended-upgrades\");\n exec(\"systemctl start unattended-upgrades\");\n\n success(\"Automatic security updates enabled\");\n}\n\n/**\n * Configure Fail2ban\n */\nexport function configureFail2ban(): void {\n step(\"Configure Fail2ban\");\n\n // Install fail2ban\n if (!commandExists(\"fail2ban-client\")) {\n exec(\"DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y fail2ban\", { silent: true });\n }\n\n // Configure jail\n const jailConfig = `# Trafic: Fail2ban configuration\n[DEFAULT]\nbantime = 3600\nfindtime = 600\nmaxretry = 5\nbackend = auto\n\n[sshd]\nenabled = true\nport = ssh\nfilter = sshd\nlogpath = /var/log/auth.log\nmaxretry = 3\nbantime = 7200\n`;\n\n writeFileSync(\"/etc/fail2ban/jail.local\", jailConfig);\n exec(\"chmod 644 /etc/fail2ban/jail.local\");\n\n // Restart fail2ban\n exec(\"systemctl enable fail2ban\");\n exec(\"systemctl restart fail2ban\");\n\n success(\"Fail2ban enabled: SSH brute force protection active\");\n}\n\n/**\n * Configure system limits\n */\nexport function configureSystemLimits(): void {\n step(\"Configure system limits\");\n\n const limitsConfig = `# Trafic: System limits for ddev user\nddev soft nofile 65536\nddev hard nofile 65536\nddev soft nproc 4096\nddev hard nproc 4096\n`;\n\n writeFileSync(\"/etc/security/limits.d/trafic.conf\", limitsConfig);\n exec(\"chmod 644 /etc/security/limits.d/trafic.conf\");\n\n success(\"System limits configured for ddev user\");\n}\n\n/**\n * Set proper file permissions\n */\nexport function configureFilePermissions(): void {\n step(\"Configure file permissions\");\n\n // Create directories\n exec(\"mkdir -p /etc/trafic\");\n exec(\"mkdir -p /var/lib/trafic\");\n exec(\"mkdir -p /var/backups/trafic\");\n\n // Set permissions\n exec(\"chmod 755 /etc/trafic\");\n exec(\"chmod 700 /var/lib/trafic\");\n exec(\"chmod 700 /var/backups/trafic\");\n exec(\"chown root:ddev /etc/trafic\");\n exec(\"chown ddev:ddev /var/lib/trafic\");\n exec(\"chown ddev:ddev /var/backups/trafic\");\n\n // Config file (if exists)\n if (existsSync(\"/etc/trafic/config.toml\")) {\n exec(\"chmod 640 /etc/trafic/config.toml\");\n exec(\"chown root:ddev /etc/trafic/config.toml\");\n }\n\n success(\"File permissions configured\");\n}\n\n/**\n * Run all hardening steps\n */\nexport function hardenServer(sshUsers: string[] = [\"ddev\"]): void {\n hardenSsh(sshUsers);\n configureFirewall();\n configureUnattendedUpgrades();\n configureFail2ban();\n configureSystemLimits();\n configureFilePermissions();\n}\n","import { execSync } from \"node:child_process\";\nimport { existsSync, readFileSync } from \"node:fs\";\nimport type { AuditCheck } from \"./types.js\";\n\n/**\n * Run a command silently and return output\n */\nfunction execSilent(command: string): string {\n try {\n return execSync(command, { encoding: \"utf-8\", stdio: \"pipe\" }).trim();\n } catch {\n return \"\";\n }\n}\n\n/**\n * Check if a service is active\n */\nfunction isServiceActive(service: string): boolean {\n const status = execSilent(`systemctl is-active ${service}`);\n return status === \"active\";\n}\n\n/**\n * Audit SSH configuration\n */\nfunction auditSsh(): AuditCheck[] {\n const checks: AuditCheck[] = [];\n\n // Check root login\n const sshdConfig = existsSync(\"/etc/ssh/sshd_config\")\n ? readFileSync(\"/etc/ssh/sshd_config\", \"utf-8\")\n : \"\";\n const traficConfig = existsSync(\"/etc/ssh/sshd_config.d/trafic.conf\")\n ? readFileSync(\"/etc/ssh/sshd_config.d/trafic.conf\", \"utf-8\")\n : \"\";\n\n const config = sshdConfig + \"\\n\" + traficConfig;\n\n const rootLoginDisabled =\n config.includes(\"PermitRootLogin no\") ||\n config.includes(\"PermitRootLogin prohibit-password\");\n checks.push({\n name: \"SSH root login\",\n status: rootLoginDisabled ? \"pass\" : \"fail\",\n message: rootLoginDisabled\n ? \"Root login disabled\"\n : \"Root login may be enabled\",\n fix: \"Add 'PermitRootLogin no' to /etc/ssh/sshd_config.d/trafic.conf\",\n });\n\n const passwordAuthDisabled = config.includes(\"PasswordAuthentication no\");\n checks.push({\n name: \"SSH password auth\",\n status: passwordAuthDisabled ? \"pass\" : \"warn\",\n message: passwordAuthDisabled\n ? \"Password authentication disabled\"\n : \"Password authentication may be enabled\",\n fix: \"Add 'PasswordAuthentication no' to /etc/ssh/sshd_config.d/trafic.conf\",\n });\n\n return checks;\n}\n\n/**\n * Audit firewall configuration\n */\nfunction auditFirewall(): AuditCheck[] {\n const checks: AuditCheck[] = [];\n\n const ufwStatus = execSilent(\"ufw status\");\n const isActive = ufwStatus.includes(\"Status: active\");\n\n checks.push({\n name: \"Firewall (UFW)\",\n status: isActive ? \"pass\" : \"fail\",\n message: isActive ? \"UFW is active\" : \"UFW is not active\",\n fix: \"Run: ufw enable\",\n });\n\n if (isActive) {\n const allows22 = ufwStatus.includes(\"22/tcp\");\n const allows80 = ufwStatus.includes(\"80/tcp\");\n const allows443 = ufwStatus.includes(\"443/tcp\");\n\n if (allows22 && allows80 && allows443) {\n checks.push({\n name: \"Firewall ports\",\n status: \"pass\",\n message: \"Required ports (22, 80, 443) are open\",\n });\n } else {\n checks.push({\n name: \"Firewall ports\",\n status: \"warn\",\n message: \"Some required ports may be blocked\",\n fix: \"Run: ufw allow 22/tcp && ufw allow 80/tcp && ufw allow 443/tcp\",\n });\n }\n }\n\n return checks;\n}\n\n/**\n * Audit security services\n */\nfunction auditServices(): AuditCheck[] {\n const checks: AuditCheck[] = [];\n\n // Fail2ban\n const fail2banActive = isServiceActive(\"fail2ban\");\n checks.push({\n name: \"Fail2ban\",\n status: fail2banActive ? \"pass\" : \"warn\",\n message: fail2banActive ? \"Fail2ban is active\" : \"Fail2ban is not running\",\n fix: \"Run: apt install fail2ban && systemctl enable fail2ban --now\",\n });\n\n // Unattended upgrades\n const unattendedActive = isServiceActive(\"unattended-upgrades\");\n checks.push({\n name: \"Automatic updates\",\n status: unattendedActive ? \"pass\" : \"warn\",\n message: unattendedActive\n ? \"Unattended upgrades enabled\"\n : \"Automatic updates not configured\",\n fix: \"Run: apt install unattended-upgrades && dpkg-reconfigure unattended-upgrades\",\n });\n\n // Trafic agent\n const agentActive = isServiceActive(\"trafic-agent\");\n checks.push({\n name: \"Trafic agent\",\n status: agentActive ? \"pass\" : \"fail\",\n message: agentActive\n ? \"Trafic agent is running\"\n : \"Trafic agent is not running\",\n fix: \"Run: systemctl start trafic-agent\",\n });\n\n return checks;\n}\n\n/**\n * Audit Docker\n */\nfunction auditDocker(): AuditCheck[] {\n const checks: AuditCheck[] = [];\n\n // Docker running\n const dockerActive = isServiceActive(\"docker\");\n checks.push({\n name: \"Docker\",\n status: dockerActive ? \"pass\" : \"fail\",\n message: dockerActive ? \"Docker is running\" : \"Docker is not running\",\n fix: \"Run: systemctl start docker\",\n });\n\n // Dangling images\n const danglingImages = execSilent(\n \"docker images -f dangling=true -q | wc -l\",\n );\n const count = parseInt(danglingImages, 10) || 0;\n if (count > 0) {\n checks.push({\n name: \"Docker cleanup\",\n status: \"warn\",\n message: `${count} dangling Docker images`,\n fix: \"Run: docker system prune -f\",\n });\n }\n\n // Disk usage\n const diskUsage = execSilent(\"df -h / | awk 'NR==2{print $5}'\");\n const usagePercent = parseInt(diskUsage, 10) || 0;\n checks.push({\n name: \"Disk usage\",\n status: usagePercent > 90 ? \"fail\" : usagePercent > 80 ? \"warn\" : \"pass\",\n message: `Disk usage: ${diskUsage}`,\n fix: usagePercent > 80 ? \"Consider cleaning up old projects or Docker resources\" : undefined,\n });\n\n return checks;\n}\n\n/**\n * Audit file permissions\n */\nfunction auditPermissions(): AuditCheck[] {\n const checks: AuditCheck[] = [];\n\n // Config file\n if (existsSync(\"/etc/trafic/config.toml\")) {\n const stats = execSilent(\"stat -c '%a' /etc/trafic/config.toml\");\n const isSecure = stats === \"640\" || stats === \"600\";\n checks.push({\n name: \"Config permissions\",\n status: isSecure ? \"pass\" : \"warn\",\n message: isSecure\n ? \"Config file has secure permissions\"\n : `Config file permissions: ${stats} (should be 640)`,\n fix: \"Run: chmod 640 /etc/trafic/config.toml\",\n });\n }\n\n // Projects directory\n if (existsSync(\"/home/ddev/www\")) {\n const owner = execSilent(\"stat -c '%U:%G' /home/ddev/www\");\n const isCorrect = owner === \"ddev:ddev\";\n checks.push({\n name: \"Projects directory\",\n status: isCorrect ? \"pass\" : \"warn\",\n message: isCorrect\n ? \"Projects directory owned by ddev\"\n : `Projects directory owner: ${owner}`,\n fix: \"Run: chown ddev:ddev /home/ddev/www\",\n });\n }\n\n return checks;\n}\n\n/**\n * Run all audit checks\n */\nexport function runAudit(): AuditCheck[] {\n return [\n ...auditSsh(),\n ...auditFirewall(),\n ...auditServices(),\n ...auditDocker(),\n ...auditPermissions(),\n ];\n}\n\n/**\n * Print audit results\n */\nexport function printAuditResults(checks: AuditCheck[]): void {\n console.log(\"\\n\\x1b[1mSecurity Audit Results\\x1b[0m\\n\");\n\n for (const check of checks) {\n const icon =\n check.status === \"pass\"\n ? \"\\x1b[32m✓\\x1b[0m\"\n : check.status === \"warn\"\n ? \"\\x1b[33m⚠\\x1b[0m\"\n : \"\\x1b[31m✗\\x1b[0m\";\n\n console.log(`${icon} \\x1b[1m${check.name}\\x1b[0m: ${check.message}`);\n\n if (check.fix && check.status !== \"pass\") {\n console.log(` \\x1b[90m${check.fix}\\x1b[0m`);\n }\n }\n\n const passed = checks.filter((c) => c.status === \"pass\").length;\n const warnings = checks.filter((c) => c.status === \"warn\").length;\n const failed = checks.filter((c) => c.status === \"fail\").length;\n\n console.log(\n `\\n\\x1b[1mSummary:\\x1b[0m ${passed} passed, ${warnings} warnings, ${failed} failed`,\n );\n}\n","import { existsSync } from \"node:fs\";\nimport { exec } from \"../steps.js\";\nimport { addDdevAptRepo } from \"../ddev.js\";\nimport type { Migration } from \"../types.js\";\n\n/**\n * Migration 0001: Migrate DDEV from manual tarball to apt repository.\n *\n * Old installs downloaded a tarball from GitHub releases. This migration\n * removes the manually-installed binaries and reinstalls DDEV via the\n * official apt repository so future updates are handled by apt.\n *\n * Condition: skip if /etc/apt/sources.list.d/ddev.list already exists,\n * which means the apt repository is already configured.\n */\nexport const migration0001DdevAptRepo: Migration = {\n id: \"0001__ddev_apt_repo\",\n description: \"Migrate DDEV from manual tarball to apt repository\",\n\n run(): void {\n // Already using the apt repository — nothing to do\n if (existsSync(\"/etc/apt/sources.list.d/ddev.list\")) {\n return;\n }\n\n // 1. Remove manually-installed DDEV binaries\n exec(\"rm -f /usr/local/bin/ddev /usr/local/bin/ddev-hostname /usr/local/bin/mkcert\", {\n silent: true,\n });\n\n // 2. Add the official DDEV apt repository\n addDdevAptRepo();\n\n // 3. Install DDEV via apt\n exec(\"apt-get update -qq\", { silent: true });\n exec(\"DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y ddev\", {\n silent: true,\n });\n\n // 4. Re-install mkcert CA (mkcert is now bundled with DDEV via apt)\n exec(\"mkcert -install\", { silent: true });\n },\n};\n","import { existsSync } from \"node:fs\";\nimport { exec } from \"../steps.js\";\nimport type { Migration } from \"../types.js\";\n\n/**\n * Migration 0002: Install mkcert CA in the ddev user trust store.\n *\n * Previously, `mkcert -install` was called as root without overriding HOME,\n * so the CA was stored under ~root/.local/share/mkcert. DDEV runs as the\n * `ddev` user and looks for the CA in its own home directory — so it never\n * found it, reporting mkcert as not installed.\n *\n * Fix: run `mkcert -install` with HOME=/home/ddev so the CA lands in the\n * ddev user trust store, then chown the directory to ddev:ddev.\n *\n * Condition: skip if /home/ddev/.local/share/mkcert already exists,\n * which means the CA is already installed for the ddev user.\n */\nexport const migration0002MkcertDdevUser: Migration = {\n id: \"0002__mkcert_ddev_user\",\n description: \"Install mkcert CA in the ddev user trust store\",\n\n run(): void {\n // Already installed for the ddev user — nothing to do\n if (existsSync(\"/home/ddev/.local/share/mkcert\")) {\n return;\n }\n\n exec(\"HOME=/home/ddev mkcert -install\", { silent: true });\n exec(\"chown -R ddev:ddev /home/ddev/.local/share/mkcert\", { silent: true });\n },\n};\n","import { existsSync, readFileSync, writeFileSync, mkdirSync } from \"node:fs\";\nimport type { Migration, MigrationState, MigrationListEntry } from \"../types.js\";\nimport { migration0001DdevAptRepo } from \"./0001__ddev_apt_repo.js\";\nimport { migration0002MkcertDdevUser } from \"./0002__mkcert_ddev_user.js\";\n\n/** Path to the persisted migration state file */\nexport const MIGRATIONS_STATE_FILE = \"/etc/trafic/.migrations.json\";\n\n/** Ordered registry of all known migrations */\nexport const ALL_MIGRATIONS: Migration[] = [migration0001DdevAptRepo, migration0002MkcertDdevUser];\n\n// ---------------------------------------------------------------------------\n// State helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Load the current migration state from disk.\n * Returns an empty state if the file does not exist yet.\n */\nexport function loadMigrationState(): MigrationState {\n if (!existsSync(MIGRATIONS_STATE_FILE)) {\n return { applied: [] };\n }\n\n try {\n const raw = readFileSync(MIGRATIONS_STATE_FILE, \"utf-8\");\n const parsed = JSON.parse(raw) as unknown;\n if (\n parsed !== null &&\n typeof parsed === \"object\" &&\n \"applied\" in parsed &&\n Array.isArray((parsed as { applied: unknown }).applied)\n ) {\n return parsed as MigrationState;\n }\n } catch {\n // Corrupted file — start fresh\n }\n\n return { applied: [] };\n}\n\n/**\n * Persist the migration state to disk.\n * Creates /etc/trafic/ if it does not exist.\n */\nexport function saveMigrationState(state: MigrationState): void {\n mkdirSync(\"/etc/trafic\", { recursive: true });\n writeFileSync(MIGRATIONS_STATE_FILE, JSON.stringify(state, null, 2) + \"\\n\", \"utf-8\");\n}\n\n// ---------------------------------------------------------------------------\n// Public API\n// ---------------------------------------------------------------------------\n\n/**\n * Return all migrations with their current status.\n */\nexport function listMigrations(): MigrationListEntry[] {\n const state = loadMigrationState();\n return ALL_MIGRATIONS.map((migration) => ({\n migration,\n status: state.applied.includes(migration.id) ? \"applied\" : \"pending\",\n }));\n}\n\n/**\n * Run all pending migrations and persist state after each one.\n *\n * When `dryRun` is true the runner prints what it would do without\n * executing anything or touching the state file.\n */\nexport function runPendingMigrations(dryRun = false): void {\n const state = loadMigrationState();\n const pending = ALL_MIGRATIONS.filter((m) => !state.applied.includes(m.id));\n\n if (pending.length === 0) {\n console.log(\" No pending migrations.\");\n return;\n }\n\n for (const migration of pending) {\n console.log(`\\n → \\x1b[1m${migration.id}\\x1b[0m ${migration.description}`);\n\n if (dryRun) {\n console.log(` \\x1b[90m(dry-run: skipped)\\x1b[0m`);\n continue;\n }\n\n migration.run();\n\n // Persist state immediately so a partial failure leaves a consistent state\n state.applied.push(migration.id);\n saveMigrationState(state);\n\n console.log(` \\x1b[32m✓ Applied\\x1b[0m`);\n }\n}\n\n/**\n * Mark all known migrations as applied without running them.\n *\n * Called at the end of a fresh `setup()` run: a brand-new server has\n * already been configured correctly, so migrations that fix older\n * installations are not needed.\n */\nexport function markAllMigrationsApplied(): void {\n const state = loadMigrationState();\n\n for (const migration of ALL_MIGRATIONS) {\n if (!state.applied.includes(migration.id)) {\n state.applied.push(migration.id);\n }\n }\n\n saveMigrationState(state);\n}\n","import type { SetupOptions } from \"./types.js\";\nimport { step, info, error, setDryRun, resetSteps, isRoot } from \"./steps.js\";\nimport { createDdevUser } from \"./user.js\";\nimport { installDocker, configureDocker, setupDockerPrune } from \"./docker.js\";\nimport { installSystemDeps, installDdev, configureDdev, configureTraefik } from \"./ddev.js\";\nimport { installNode, installAgent, createAgentConfig, createSystemdService } from \"./agent.js\";\nimport { hardenServer } from \"./hardening.js\";\nimport { runAudit, printAuditResults } from \"./audit.js\";\nimport { markAllMigrationsApplied } from \"./migrations/index.js\";\n\nexport * from \"./types.js\";\nexport * from \"./audit.js\";\n\n/**\n * Run the full server setup\n */\nexport async function setup(options: SetupOptions): Promise<void> {\n resetSteps();\n setDryRun(options.dryRun ?? false);\n\n console.log(\"\\n\\x1b[1m🚦 Trafic Server Setup\\x1b[0m\\n\");\n\n if (options.dryRun) {\n console.log(\"\\x1b[33m⚠ Dry-run mode: no changes will be made\\x1b[0m\\n\");\n }\n\n // Check root\n if (!isRoot() && !options.dryRun) {\n error(\"This command must be run as root\");\n console.log(\" Run: sudo trafic-agent setup ...\");\n process.exit(1);\n }\n\n info(`TLD: ${options.tld}`);\n if (options.email) {\n info(`Let's Encrypt email: ${options.email}`);\n }\n if (options.noHardening) {\n info(\"Hardening: disabled\");\n }\n\n try {\n // Step 1: Install system dependencies\n installSystemDeps();\n\n // Step 2: Create ddev user\n createDdevUser();\n\n // Step 3: Install Docker\n if (!options.noDocker) {\n installDocker();\n configureDocker();\n setupDockerPrune();\n } else {\n step(\"Install Docker\");\n info(\"Skipped (--no-docker)\");\n }\n\n // Step 4: Install DDEV\n if (!options.noDdev) {\n installDdev();\n configureDdev(options.tld, options.email);\n configureTraefik();\n } else {\n step(\"Install DDEV\");\n info(\"Skipped (--no-ddev)\");\n }\n\n // Step 5: Install Node.js\n installNode();\n\n // Step 6: Install and configure agent\n installAgent();\n createAgentConfig(options.tld, options.email);\n createSystemdService();\n\n // Step 7: Server hardening\n if (!options.noHardening) {\n const sshUsers = options.sshUsers ?? [\"ddev\"];\n hardenServer(sshUsers);\n } else {\n step(\"Server hardening\");\n info(\"Skipped (--no-hardening)\");\n }\n\n // Mark all migrations as applied — fresh servers are already up-to-date\n markAllMigrationsApplied();\n\n // Done\n console.log(\"\\n\\x1b[32m✓ Setup complete!\\x1b[0m\\n\");\n console.log(\"Next steps:\");\n console.log(` 1. Edit /etc/trafic/config.toml to configure authentication`);\n console.log(` 2. Add SSH public keys to /home/ddev/.ssh/authorized_keys`);\n console.log(` 3. Deploy your first project:`);\n console.log(` npx @studiometa/trafic-cli deploy --host=<this-server> --name=my-app`);\n console.log(`\\nYour projects will be available at https://<name>.${options.tld}`);\n } catch (err) {\n error(`Setup failed: ${err instanceof Error ? err.message : err}`);\n process.exit(1);\n }\n}\n\n/**\n * Run security audit\n */\nexport async function audit(): Promise<void> {\n const checks = runAudit();\n printAuditResults(checks);\n\n const failed = checks.filter((c) => c.status === \"fail\").length;\n if (failed > 0) {\n process.exit(1);\n }\n}\n"],"mappings":";;;;AAIA,IAAM,uBAAuB;CAC3B;CACA;CACA;CACD;AAED,IAAM,iBAA8B;CAClC,KAAK;CACL,MAAM;CACN,QAAQ;CACR,iBAAiB;CACjB,aAAa;CACb,aAAa;CACb,mBAAmB;CACnB,MAAM;EACJ,eAAe;EACf,YAAY,EAAE;EACd,QAAQ,EAAE;EACV,WAAW,EAAE;EACb,OAAO,EAAE;EACV;CACF;;;;AAKD,SAAgB,cAAc,UAA0B;CAEtD,MAAM,QAAQ,SAAS,MADT,oCACqB;AACnC,KAAI,CAAC,MAAO,QAAO;CAEnB,MAAM,QAAQ,SAAS,MAAM,MAAM,KAAK,GAAG;CAC3C,MAAM,UAAU,SAAS,MAAM,MAAM,KAAK,GAAG;CAC7C,MAAM,UAAU,SAAS,MAAM,MAAM,KAAK,GAAG;AAE7C,SAAQ,QAAQ,OAAO,UAAU,KAAK,WAAW;;;;;AAMnD,SAAgB,WAAW,YAAkC;CAE3D,IAAI,OAAO;AACX,KAAI,CAAC,KACH,QAAO,qBAAqB,MAAM,MAAM,WAAW,EAAE,CAAC;AAGxD,KAAI,CAAC,QAAQ,CAAC,WAAW,KAAK,EAAE;AAC9B,UAAQ,KAAK,uCAAuC;AACpD,SAAO;;CAIT,MAAM,SAAS,MADC,aAAa,MAAM,QAAQ,CACd;CAG7B,MAAM,OAAO,gBAAgB,OAAO,KAAgC;AAEpE,QAAO;EACL,KAAM,OAAO,OAAkB,eAAe;EAC9C,MAAO,OAAO,QAAmB,eAAe;EAChD,QAAS,OAAO,WAAsB,eAAe;EACrD,iBACG,OAAO,qBAAgC,eAAe;EACzD,aAAc,OAAO,gBAA2B,eAAe;EAC/D,aACG,OAAO,gBAA2B,eAAe;EACpD,mBACG,OAAO,uBACR,eAAe;EACjB;EACD;;AAGH,SAAS,gBAAgB,KAA2C;AAClE,KAAI,CAAC,IAAK,QAAO,eAAe;CAEhC,MAAM,QAAS,IAAI,SAA4C,EAAE;AAEjE,QAAO;EACL,eACG,IAAI,kBACL,eAAe,KAAK;EACtB,YACG,IAAI,eAA4B,eAAe,KAAK;EACvD,QAAS,IAAI,UAAuB,eAAe,KAAK;EACxD,WAAY,IAAI,cAA2B,eAAe,KAAK;EAC/D,OAAO,MAAM,KACV,OAAiB;GAChB,OAAO,EAAE;GACT,QAAQ,EAAE;GACV,QAAQ,EAAE;GACV,YAAY,EAAE;GACf,EACF;EACF;;;;;AAMH,SAAgB,eAAe,QAA+B;CAC5D,MAAM,SAAmB,EAAE;AAE3B,KAAI,CAAC,OAAO,IACV,QAAO,KAAK,kBAAkB;AAGhC,KAAI,OAAO,OAAO,KAAK,OAAO,OAAO,MACnC,QAAO,KAAK,mCAAmC;AAGjD,KACE,OAAO,KAAK,kBAAkB,WAC9B,OAAO,KAAK,kBAAkB,UAC9B,OAAO,KAAK,kBAAkB,WAC9B,OAAO,KAAK,kBAAkB,QAE9B,QAAO,KAAK,2EAAmE;AAGjF,QAAO;;;;;;ACpHT,SAAgB,iBAAiB,QAA2B;CAC1D,MAAM,oBAAoB,cAAc,OAAO,YAAY;CAG3D,MAAM,WAAW,gBAAgB,OAAO,gBAAgB;CAGxD,MAAM,eAAe,gBAAgB,kBAAkB;AAEvD,MAAK,MAAM,WAAW,cAAc;EAClC,MAAM,aAAa,SAAS,IAAI,QAAQ,KAAK;AAG7C,MAAI,YAAY;GACd,MAAM,gBAAgB,kBAAkB,WAAW;AAGnD,OAAI,gBAAgB,cAAc,CAChC;GAIF,MAAM,qBAAqB,iBAAiB,cAAc;AAC1D,OAAI,uBAAuB,KAAA;QACJ,KAAK,KAAK,GAAG,QAAQ,aACvB,mBAEjB;;;AAON,MADa,eAAe,QAAQ,KAAK,EAC/B,WAAW,WAAW;AAE9B,oBAAiB,QAAQ,MAAM,UAAU;AACzC;;AAGF,UAAQ,IAAI,0BAA0B,QAAQ,OAAO;AAGrD,MAFgB,YAAY,QAAQ,KAAK,EAE5B;AACX,oBAAiB,QAAQ,MAAM,UAAU;AACzC,WAAQ,IAAI,YAAY,QAAQ,OAAO;QAEvC,SAAQ,MAAM,mBAAmB,QAAQ,OAAO;;;;;;AAQtD,SAAgB,mBAAmB,QAAqC;CACtE,MAAM,aAAa,cAAc,OAAO,kBAAkB;AAE1D,SAAQ,IACN,0CAA0C,OAAO,kBAAkB,YAAY,OAAO,cACvF;AAGD,kBAAiB,OAAO;AAGxB,QAAO,kBAAkB;AACvB,mBAAiB,OAAO;IACvB,WAAW;;AC3EhB,IAAI,aAAa;AACjB,IAAI,SAAS;;;;AAKb,SAAgB,UAAU,OAAsB;AAC9C,UAAS;;;;;AAMX,SAAgB,aAAmB;AACjC,cAAa;;;;;AAMf,SAAgB,KAAK,SAAuB;AAC1C;AACA,SAAQ,IAAI,cAAc,WAAW,WAAW,UAAU;;;;;AAM5D,SAAgB,QAAQ,SAAuB;AAC7C,SAAQ,IAAI,wBAAwB,UAAU;;;;;AAMhD,SAAgB,KAAK,SAAuB;AAC1C,SAAQ,IAAI,wBAAwB,UAAU;;;;;AAMhD,SAAgB,MAAM,SAAuB;AAC3C,SAAQ,IAAI,wBAAwB,UAAU;;;;;AAMhD,SAAgB,KAAK,SAAuB;AAC1C,SAAQ,IAAI,OAAO,UAAU;;;;;AAM/B,SAAgB,KAAK,SAAiB,SAAwC;AAC5E,KAAI,QAAQ;AACV,MAAI,CAAC,SAAS,OACZ,SAAQ,IAAI,iBAAiB,QAAQ,SAAS;AAEhD,SAAO;;AAGT,KAAI;AACF,SAAO,SAAS,SAAS;GACvB,UAAU;GACV,OAAO,SAAS,SAAS,SAAS;GACnC,CAAC;UACK,KAAK;EACZ,MAAM,IAAI;AACV,QAAM,IAAI,MAAM,mBAAmB,QAAQ,IAAI,EAAE,UAAU,KAAK;;;;;;AAOpE,SAAgB,aAAW,SAAyB;AAClD,KAAI,OACF,QAAO;AAGT,KAAI;AACF,SAAO,SAAS,SAAS;GACvB,UAAU;GACV,OAAO;GACR,CAAC,CAAC,MAAM;SACH;AACN,SAAO;;;;;;AAOX,SAAgB,cAAc,SAA0B;AACtD,KAAI;AACF,WAAS,SAAS,WAAW,EAAE,OAAO,QAAQ,CAAC;AAC/C,SAAO;SACD;AACN,SAAO;;;;;;AAOX,SAAgB,SAAkB;AAChC,QAAO,QAAQ,UAAU,KAAK;;;;;AC3GhC,SAAgB,iBAAuB;AACrC,MAAK,mBAAmB;AAIxB,KADmB,aAAW,yBAAyB,CAErD,MAAK,6BAA6B;MAC7B;AACL,OAAK,+BAA+B;AACpC,UAAQ,sBAAsB;;AAIhC,MAAK,+CAA+C,EAAE,QAAQ,MAAM,CAAC;AAGrE,MAAK,0BAA0B;AAC/B,MAAK,iCAAiC;AACtC,MAAK,2BAA2B;AAChC,SAAQ,yBAAyB;AAGjC,MAAK,2BAA2B;AAChC,MAAK,4BAA4B;AACjC,MAAK,kCAAkC;AAYvC,SAAQ,wDAAwD;;;;;ACnClE,SAAgB,gBAAsB;AACpC,MAAK,iBAAiB;AAEtB,KAAI,cAAc,SAAS,EAAE;AAE3B,OAAK,6BADW,KAAK,oBAAoB,EAAE,QAAQ,MAAM,CAAC,EACf,MAAM,IAAI,oBAAoB;AACzE;;AAIF,MAAK,mDAAmD;AACxD,MAAK,0DAA0D;AAC/D,MAAK,yBAAyB,EAAE,QAAQ,MAAM,CAAC;AAC/C,MAAK,wBAAwB;AAG7B,MAAK,2BAA2B,EAAE,QAAQ,MAAM,CAAC;AACjD,MAAK,0BAA0B,EAAE,QAAQ,MAAM,CAAC;AAEhD,SAAQ,+BAA+B;AAGvC,MAAK,2BAA2B,EAAE,QAAQ,MAAM,CAAC;AACjD,SAAQ,kCAAkC;;;;;AAM5C,SAAgB,kBAAwB;AACtC,MAAK,mBAAmB;CAGxB,MAAM,eAAe;EACnB,cAAc;EACd,YAAY;GACV,YAAY;GACZ,YAAY;GACb;EACD,kBAAkB;EAClB,gBAAgB;EACjB;AAED,MAAK,uBAAuB;CAE5B,MAAM,aAAa;AAGnB,KAAI,WAAW,WAAW,CACxB,KAAI;EAGF,MAAM,SAAS;GAAE,GAFA,KAAK,MAAM,aAAa,YAAY,QAAQ,CAAC;GAEhC,GAAG;GAAc;AAC/C,gBAAc,YAAY,KAAK,UAAU,QAAQ,MAAM,EAAE,CAAC;AAC1D,OAAK,qCAAqC;SACpC;AACN,OAAK,mDAAmD;AACxD;;KAGF,eAAc,YAAY,KAAK,UAAU,cAAc,MAAM,EAAE,CAAC;AAIlE,MAAK,sDAAsD;AAC3D,SAAQ,6CAA6C;;;;;AAMvD,SAAgB,mBAAyB;AACvC,MAAK,4BAA4B;AAMjC,eAAc,mCAJM;;EAIyC;AAC7D,MAAK,4CAA4C;AAEjD,SAAQ,kDAAkD;;;;;ACjF5D,SAAgB,oBAA0B;AACxC,MAAK,8BAA8B;AAEnC,MAAK,sBAAsB,EAAE,QAAQ,MAAM,CAAC;AAC5C,MAAK,sFAAsF,EAAE,QAAQ,MAAM,CAAC;AAE5G,SAAQ,iDAAiD;;;;;;AAO3D,SAAgB,iBAAuB;AACrC,MAAK,wCAAwC,EAAE,QAAQ,MAAM,CAAC;AAC9D,MACE,4GACA,EAAE,QAAQ,MAAM,CACjB;AACD,MAAK,wCAAwC,EAAE,QAAQ,MAAM,CAAC;AAC9D,MACE,yIACA,EAAE,QAAQ,MAAM,CACjB;;;;;AAMH,SAAgB,cAAoB;AAClC,MAAK,eAAe;AAEpB,KAAI,cAAc,OAAO,EAAE;AAEzB,OAAK,2BADW,KAAK,wCAAwC,EAAE,QAAQ,MAAM,CAAC,EACrC,MAAM,IAAI,oBAAoB;AACvE;;AAKF,MAAK,gCAAgC;AACrC,iBAAgB;AAEhB,MAAK,qBAAqB;AAC1B,MAAK,sBAAsB,EAAE,QAAQ,MAAM,CAAC;AAC5C,MAAK,6EAA6E,EAAE,QAAQ,MAAM,CAAC;AAMnG,MAAK,mCAAmC,EAAE,QAAQ,MAAM,CAAC;AACzD,MAAK,qDAAqD,EAAE,QAAQ,MAAM,CAAC;AAG3E,SAAQ,mBADQ,KAAK,wCAAwC,EAAE,QAAQ,MAAM,CAAC,EAC1C,MAAM,IAAI,oBAAoB;;;;;;;;;;;;;AAcpE,SAAgB,cAAc,KAAa,OAAsB;AAC/D,MAAK,iBAAiB;CAGtB,MAAM,WAAW,QAAgB,iBAAiB,IAAI;AAGtD,MACE,QACE,oCAAoC,IAAI,mEAAmE,QAAQ,SAAS,QAAQ,GAAG,QAAQ,uBAAuB,UAAU,GAAG,iCACpL,EACD,EAAE,QAAQ,MAAM,CACjB;AAED,SAAQ,6BAA6B,MAAM;AAC3C,MAAK,+BAA+B,IAAI,cAAc;AAEtD,KAAI,MACF,SAAQ,qCAAqC,QAAQ;AAGvD,SAAQ,kCAAkC;;;;;AAmD5C,SAAgB,mBAAyB;AACvC,MAAK,qCAAqC;AAG1C,MAAK,qCAAqC,EAAE,QAAQ,MAAM,CAAC;AAC3D,MAAK,uCAAuC,EAAE,QAAQ,MAAM,CAAC;AA2B7D,eAAc,wCAxBO;;;;;;;;;;;;;;;;;;;;;;EAwB8C;AACnE,MAAK,wDAAwD,EAAE,QAAQ,MAAM,CAAC;AAgB9E,eAAc,yCAbO;;;;;;;;;;;EAa+C;AACpE,MAAK,yDAAyD,EAAE,QAAQ,MAAM,CAAC;AAE/E,SAAQ,4CAA4C;;;;;ACjMtD,SAAgB,cAAoB;AAClC,MAAK,kBAAkB;AAGvB,KAAI,cAAc,OAAO,EAAE;AAEzB,OAAK,8BADW,KAAK,kBAAkB,EAAE,QAAQ,MAAM,CAAC,EACZ,MAAM,GAAG;AACrD;;AAIF,MACE,iGACD;AASD,eAAc,yBANS;;;;EAM+B;AACtD,MAAK,kCAAkC;AAGvC,MAAK,qDAAqD;AAC1D,MAAK,qDAAqD;AAG1D,MACE,uEACD;AACD,MAAK,qEAAqE;AAC1E,MAAK,qEAAqE;AAE1E,SAAQ,+BAA+B;;;;;AAMzC,SAAgB,eAAqB;AACnC,MAAK,uBAAuB;AAG5B,MAAK,0CAA0C;AAE/C,SAAQ,yBAAyB;;;;;AAMnC,SAAgB,kBAAkB,KAAa,QAAuB;AACpE,MAAK,6BAA6B;AAGlC,MAAK,uBAAuB;AAC5B,MAAK,2BAA2B;AAChC,MAAK,kCAAkC;CAEvC,MAAM,aAAa;AAEnB,KAAI,WAAW,WAAW,EAAE;AAC1B,OAAK,qEAAqE;AAC1E,OAAK,6CAA6C;AAClD;;AA8BF,eAAc,YA3BC;;;;SAIR,IAAI;;;;;;;;;;;;;;;;;;;;;EAuBsB;AACjC,MAAK,oCAAoC;AACzC,MAAK,0CAA0C;AAE/C,SAAQ,mDAAmD;AAC3D,MAAK,6CAA6C;;;;;AAMpD,SAAgB,uBAA6B;AAC3C,MAAK,yBAAyB;AAuC9B,eAAc,4CAlCS;;;;;;;;;YAFL,KAAK,sBAAsB,EAAE,QAAQ,MAAM,CAAC,EAAE,MAAM,IAAI,wBAWtD;;;;;;;;;;;;;;;;;;;;;;;EAyBqD;AACzE,MAAK,qDAAqD;AAG1D,MAAK,0BAA0B;AAC/B,MAAK,gCAAgC;AACrC,MAAK,+BAA+B;AAEpC,SAAQ,+BAA+B;AACvC,MAAK,2CAA2C;;;;;AC7JlD,SAAgB,UAAU,eAAyB,CAAC,OAAO,EAAQ;AACjE,MAAK,2BAA2B;AAkChC,eAAc,sCAhCI;;;;;;;;;;;;;;;;;;kBAkBF,aAAa,KAAK,IAAI,CAAC;;;;;;;;;;;;EAcuB;AAC9D,MAAK,+CAA+C;AAIpD,KADmB,KAAK,gCAAgC,EAAE,QAAQ,MAAM,CAAC,EACzD,SAAS,QAAQ,EAAE;AACjC,OAAK,uCAAuC;AAC5C,OAAK,wCAAwC;AAC7C;;AAGF,MAAK,gDAAgD;AACrD,SAAQ,qEAAqE;AAC7E,MAAK,wBAAwB,aAAa,KAAK,KAAK,GAAG;;;;;AAMzD,SAAgB,oBAA0B;AACxC,MAAK,2BAA2B;AAGhC,KAAI,CAAC,cAAc,MAAM,CACvB,MAAK,4EAA4E,EAAE,QAAQ,MAAM,CAAC;AAIpG,MAAK,qBAAqB,EAAE,QAAQ,MAAM,CAAC;AAC3C,MAAK,4BAA4B;AACjC,MAAK,6BAA6B;AAClC,MAAK,iCAAiC;AACtC,MAAK,kCAAkC;AACvC,MAAK,oCAAoC;AAGzC,MAAK,qBAAqB;AAE1B,SAAQ,6DAA6D;;;;;AAMvE,SAAgB,8BAAoC;AAClD,MAAK,uCAAuC;AAG5C,MACE,4GACA,EAAE,QAAQ,MAAM,CACjB;AAqBD,eACE,6CAnBqB;;;;;;;;;;;;;;;;EAqBtB;AASD,eAAc,uCANK;;;;EAM6C;AAGhE,MAAK,uCAAuC;AAC5C,MAAK,sCAAsC;AAE3C,SAAQ,qCAAqC;;;;;AAM/C,SAAgB,oBAA0B;AACxC,MAAK,qBAAqB;AAG1B,KAAI,CAAC,cAAc,kBAAkB,CACnC,MAAK,iFAAiF,EAAE,QAAQ,MAAM,CAAC;AAoBzG,eAAc,4BAhBK;;;;;;;;;;;;;;EAgBkC;AACrD,MAAK,qCAAqC;AAG1C,MAAK,4BAA4B;AACjC,MAAK,6BAA6B;AAElC,SAAQ,sDAAsD;;;;;AAMhE,SAAgB,wBAA8B;AAC5C,MAAK,0BAA0B;AAS/B,eAAc,sCAPO;;;;;EAO4C;AACjE,MAAK,+CAA+C;AAEpD,SAAQ,yCAAyC;;;;;AAMnD,SAAgB,2BAAiC;AAC/C,MAAK,6BAA6B;AAGlC,MAAK,uBAAuB;AAC5B,MAAK,2BAA2B;AAChC,MAAK,+BAA+B;AAGpC,MAAK,wBAAwB;AAC7B,MAAK,4BAA4B;AACjC,MAAK,gCAAgC;AACrC,MAAK,8BAA8B;AACnC,MAAK,kCAAkC;AACvC,MAAK,sCAAsC;AAG3C,KAAI,WAAW,0BAA0B,EAAE;AACzC,OAAK,oCAAoC;AACzC,OAAK,0CAA0C;;AAGjD,SAAQ,8BAA8B;;;;;AAMxC,SAAgB,aAAa,WAAqB,CAAC,OAAO,EAAQ;AAChE,WAAU,SAAS;AACnB,oBAAmB;AACnB,8BAA6B;AAC7B,oBAAmB;AACnB,wBAAuB;AACvB,2BAA0B;;;;;AC7N5B,SAAS,WAAW,SAAyB;AAC3C,KAAI;AACF,SAAO,SAAS,SAAS;GAAE,UAAU;GAAS,OAAO;GAAQ,CAAC,CAAC,MAAM;SAC/D;AACN,SAAO;;;;;;AAOX,SAAS,gBAAgB,SAA0B;AAEjD,QADe,WAAW,uBAAuB,UAAU,KACzC;;;;;AAMpB,SAAS,WAAyB;CAChC,MAAM,SAAuB,EAAE;CAG/B,MAAM,aAAa,WAAW,uBAAuB,GACjD,aAAa,wBAAwB,QAAQ,GAC7C;CACJ,MAAM,eAAe,WAAW,qCAAqC,GACjE,aAAa,sCAAsC,QAAQ,GAC3D;CAEJ,MAAM,SAAS,aAAa,OAAO;CAEnC,MAAM,oBACJ,OAAO,SAAS,qBAAqB,IACrC,OAAO,SAAS,oCAAoC;AACtD,QAAO,KAAK;EACV,MAAM;EACN,QAAQ,oBAAoB,SAAS;EACrC,SAAS,oBACL,wBACA;EACJ,KAAK;EACN,CAAC;CAEF,MAAM,uBAAuB,OAAO,SAAS,4BAA4B;AACzE,QAAO,KAAK;EACV,MAAM;EACN,QAAQ,uBAAuB,SAAS;EACxC,SAAS,uBACL,qCACA;EACJ,KAAK;EACN,CAAC;AAEF,QAAO;;;;;AAMT,SAAS,gBAA8B;CACrC,MAAM,SAAuB,EAAE;CAE/B,MAAM,YAAY,WAAW,aAAa;CAC1C,MAAM,WAAW,UAAU,SAAS,iBAAiB;AAErD,QAAO,KAAK;EACV,MAAM;EACN,QAAQ,WAAW,SAAS;EAC5B,SAAS,WAAW,kBAAkB;EACtC,KAAK;EACN,CAAC;AAEF,KAAI,UAAU;EACZ,MAAM,WAAW,UAAU,SAAS,SAAS;EAC7C,MAAM,WAAW,UAAU,SAAS,SAAS;EAC7C,MAAM,YAAY,UAAU,SAAS,UAAU;AAE/C,MAAI,YAAY,YAAY,UAC1B,QAAO,KAAK;GACV,MAAM;GACN,QAAQ;GACR,SAAS;GACV,CAAC;MAEF,QAAO,KAAK;GACV,MAAM;GACN,QAAQ;GACR,SAAS;GACT,KAAK;GACN,CAAC;;AAIN,QAAO;;;;;AAMT,SAAS,gBAA8B;CACrC,MAAM,SAAuB,EAAE;CAG/B,MAAM,iBAAiB,gBAAgB,WAAW;AAClD,QAAO,KAAK;EACV,MAAM;EACN,QAAQ,iBAAiB,SAAS;EAClC,SAAS,iBAAiB,uBAAuB;EACjD,KAAK;EACN,CAAC;CAGF,MAAM,mBAAmB,gBAAgB,sBAAsB;AAC/D,QAAO,KAAK;EACV,MAAM;EACN,QAAQ,mBAAmB,SAAS;EACpC,SAAS,mBACL,gCACA;EACJ,KAAK;EACN,CAAC;CAGF,MAAM,cAAc,gBAAgB,eAAe;AACnD,QAAO,KAAK;EACV,MAAM;EACN,QAAQ,cAAc,SAAS;EAC/B,SAAS,cACL,4BACA;EACJ,KAAK;EACN,CAAC;AAEF,QAAO;;;;;AAMT,SAAS,cAA4B;CACnC,MAAM,SAAuB,EAAE;CAG/B,MAAM,eAAe,gBAAgB,SAAS;AAC9C,QAAO,KAAK;EACV,MAAM;EACN,QAAQ,eAAe,SAAS;EAChC,SAAS,eAAe,sBAAsB;EAC9C,KAAK;EACN,CAAC;CAGF,MAAM,iBAAiB,WACrB,4CACD;CACD,MAAM,QAAQ,SAAS,gBAAgB,GAAG,IAAI;AAC9C,KAAI,QAAQ,EACV,QAAO,KAAK;EACV,MAAM;EACN,QAAQ;EACR,SAAS,GAAG,MAAM;EAClB,KAAK;EACN,CAAC;CAIJ,MAAM,YAAY,WAAW,kCAAkC;CAC/D,MAAM,eAAe,SAAS,WAAW,GAAG,IAAI;AAChD,QAAO,KAAK;EACV,MAAM;EACN,QAAQ,eAAe,KAAK,SAAS,eAAe,KAAK,SAAS;EAClE,SAAS,eAAe;EACxB,KAAK,eAAe,KAAK,0DAA0D,KAAA;EACpF,CAAC;AAEF,QAAO;;;;;AAMT,SAAS,mBAAiC;CACxC,MAAM,SAAuB,EAAE;AAG/B,KAAI,WAAW,0BAA0B,EAAE;EACzC,MAAM,QAAQ,WAAW,uCAAuC;EAChE,MAAM,WAAW,UAAU,SAAS,UAAU;AAC9C,SAAO,KAAK;GACV,MAAM;GACN,QAAQ,WAAW,SAAS;GAC5B,SAAS,WACL,uCACA,4BAA4B,MAAM;GACtC,KAAK;GACN,CAAC;;AAIJ,KAAI,WAAW,iBAAiB,EAAE;EAChC,MAAM,QAAQ,WAAW,iCAAiC;EAC1D,MAAM,YAAY,UAAU;AAC5B,SAAO,KAAK;GACV,MAAM;GACN,QAAQ,YAAY,SAAS;GAC7B,SAAS,YACL,qCACA,6BAA6B;GACjC,KAAK;GACN,CAAC;;AAGJ,QAAO;;;;;AAMT,SAAgB,WAAyB;AACvC,QAAO;EACL,GAAG,UAAU;EACb,GAAG,eAAe;EAClB,GAAG,eAAe;EAClB,GAAG,aAAa;EAChB,GAAG,kBAAkB;EACtB;;;;;AAMH,SAAgB,kBAAkB,QAA4B;AAC5D,SAAQ,IAAI,2CAA2C;AAEvD,MAAK,MAAM,SAAS,QAAQ;EAC1B,MAAM,OACJ,MAAM,WAAW,SACb,qBACA,MAAM,WAAW,SACf,qBACA;AAER,UAAQ,IAAI,GAAG,KAAK,UAAU,MAAM,KAAK,WAAW,MAAM,UAAU;AAEpE,MAAI,MAAM,OAAO,MAAM,WAAW,OAChC,SAAQ,IAAI,aAAa,MAAM,IAAI,SAAS;;CAIhD,MAAM,SAAS,OAAO,QAAQ,MAAM,EAAE,WAAW,OAAO,CAAC;CACzD,MAAM,WAAW,OAAO,QAAQ,MAAM,EAAE,WAAW,OAAO,CAAC;CAC3D,MAAM,SAAS,OAAO,QAAQ,MAAM,EAAE,WAAW,OAAO,CAAC;AAEzD,SAAQ,IACN,4BAA4B,OAAO,WAAW,SAAS,aAAa,OAAO,SAC5E;;;;;;;;;;;;ACxPH,MAAa,2BAAsC;CACjD,IAAI;CACJ,aAAa;CAEb,MAAY;AAEV,MAAI,WAAW,oCAAoC,CACjD;AAIF,OAAK,gFAAgF,EACnF,QAAQ,MACT,CAAC;AAGF,kBAAgB;AAGhB,OAAK,sBAAsB,EAAE,QAAQ,MAAM,CAAC;AAC5C,OAAK,6EAA6E,EAChF,QAAQ,MACT,CAAC;AAGF,OAAK,mBAAmB,EAAE,QAAQ,MAAM,CAAC;;CAE5C;;;;;;;;;;;;;;;ACxBD,MAAa,8BAAyC;CACpD,IAAI;CACJ,aAAa;CAEb,MAAY;AAEV,MAAI,WAAW,iCAAiC,CAC9C;AAGF,OAAK,mCAAmC,EAAE,QAAQ,MAAM,CAAC;AACzD,OAAK,qDAAqD,EAAE,QAAQ,MAAM,CAAC;;CAE9E;;ACzBD,MAAa,wBAAwB;;AAGrC,MAAa,iBAA8B,CAAC,0BAA0B,4BAA4B;;;;;AAUlG,SAAgB,qBAAqC;AACnD,KAAI,CAAC,WAAA,+BAAiC,CACpC,QAAO,EAAE,SAAS,EAAE,EAAE;AAGxB,KAAI;EACF,MAAM,MAAM,aAAa,uBAAuB,QAAQ;EACxD,MAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,MACE,WAAW,QACX,OAAO,WAAW,YAClB,aAAa,UACb,MAAM,QAAS,OAAgC,QAAQ,CAEvD,QAAO;SAEH;AAIR,QAAO,EAAE,SAAS,EAAE,EAAE;;;;;;AAOxB,SAAgB,mBAAmB,OAA6B;AAC9D,WAAU,eAAe,EAAE,WAAW,MAAM,CAAC;AAC7C,eAAc,uBAAuB,KAAK,UAAU,OAAO,MAAM,EAAE,GAAG,MAAM,QAAQ;;;;;AAUtF,SAAgB,iBAAuC;CACrD,MAAM,QAAQ,oBAAoB;AAClC,QAAO,eAAe,KAAK,eAAe;EACxC;EACA,QAAQ,MAAM,QAAQ,SAAS,UAAU,GAAG,GAAG,YAAY;EAC5D,EAAE;;;;;;;;AASL,SAAgB,qBAAqB,SAAS,OAAa;CACzD,MAAM,QAAQ,oBAAoB;CAClC,MAAM,UAAU,eAAe,QAAQ,MAAM,CAAC,MAAM,QAAQ,SAAS,EAAE,GAAG,CAAC;AAE3E,KAAI,QAAQ,WAAW,GAAG;AACxB,UAAQ,IAAI,2BAA2B;AACvC;;AAGF,MAAK,MAAM,aAAa,SAAS;AAC/B,UAAQ,IAAI,gBAAgB,UAAU,GAAG,WAAW,UAAU,cAAc;AAE5E,MAAI,QAAQ;AACV,WAAQ,IAAI,wCAAwC;AACpD;;AAGF,YAAU,KAAK;AAGf,QAAM,QAAQ,KAAK,UAAU,GAAG;AAChC,qBAAmB,MAAM;AAEzB,UAAQ,IAAI,+BAA+B;;;;;;;;;;AAW/C,SAAgB,2BAAiC;CAC/C,MAAM,QAAQ,oBAAoB;AAElC,MAAK,MAAM,aAAa,eACtB,KAAI,CAAC,MAAM,QAAQ,SAAS,UAAU,GAAG,CACvC,OAAM,QAAQ,KAAK,UAAU,GAAG;AAIpC,oBAAmB,MAAM;;;;;ACnG3B,eAAsB,MAAM,SAAsC;AAChE,aAAY;AACZ,WAAU,QAAQ,UAAU,MAAM;AAElC,SAAQ,IAAI,2CAA2C;AAEvD,KAAI,QAAQ,OACV,SAAQ,IAAI,2DAA2D;AAIzE,KAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,QAAQ;AAChC,QAAM,mCAAmC;AACzC,UAAQ,IAAI,qCAAqC;AACjD,UAAQ,KAAK,EAAE;;AAGjB,MAAK,QAAQ,QAAQ,MAAM;AAC3B,KAAI,QAAQ,MACV,MAAK,wBAAwB,QAAQ,QAAQ;AAE/C,KAAI,QAAQ,YACV,MAAK,sBAAsB;AAG7B,KAAI;AAEF,qBAAmB;AAGnB,kBAAgB;AAGhB,MAAI,CAAC,QAAQ,UAAU;AACrB,kBAAe;AACf,oBAAiB;AACjB,qBAAkB;SACb;AACL,QAAK,iBAAiB;AACtB,QAAK,wBAAwB;;AAI/B,MAAI,CAAC,QAAQ,QAAQ;AACnB,gBAAa;AACb,iBAAc,QAAQ,KAAK,QAAQ,MAAM;AACzC,qBAAkB;SACb;AACL,QAAK,eAAe;AACpB,QAAK,sBAAsB;;AAI7B,eAAa;AAGb,gBAAc;AACd,oBAAkB,QAAQ,KAAK,QAAQ,MAAM;AAC7C,wBAAsB;AAGtB,MAAI,CAAC,QAAQ,YAEX,cADiB,QAAQ,YAAY,CAAC,OAAO,CACvB;OACjB;AACL,QAAK,mBAAmB;AACxB,QAAK,2BAA2B;;AAIlC,4BAA0B;AAG1B,UAAQ,IAAI,uCAAuC;AACnD,UAAQ,IAAI,cAAc;AAC1B,UAAQ,IAAI,gEAAgE;AAC5E,UAAQ,IAAI,8DAA8D;AAC1E,UAAQ,IAAI,kCAAkC;AAC9C,UAAQ,IAAI,4EAA4E;AACxF,UAAQ,IAAI,uDAAuD,QAAQ,MAAM;UAC1E,KAAK;AACZ,QAAM,iBAAiB,eAAe,QAAQ,IAAI,UAAU,MAAM;AAClE,UAAQ,KAAK,EAAE;;;;;;AAOnB,eAAsB,QAAuB;CAC3C,MAAM,SAAS,UAAU;AACzB,mBAAkB,OAAO;AAGzB,KADe,OAAO,QAAQ,MAAM,EAAE,WAAW,OAAO,CAAC,SAC5C,EACX,SAAQ,KAAK,EAAE"}