@studiometa/trafic-agent 0.1.25 → 0.1.26

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { _ as validateConfig, c as info, d as success, f as warn, h as loadConfig, i as runPendingMigrations, l as isRoot, n as setup, p as startIdleScheduler, r as listMigrations, s as exec, t as audit, u as step } from "./setup-D61uhYiJ.js";
+import { _ as validateConfig, c as info, d as success, f as warn, h as loadConfig, i as runPendingMigrations, l as isRoot, n as setup, p as startIdleScheduler, r as listMigrations, s as exec, t as audit, u as step } from "./setup-4TI2lreq.js";
 import { o as closeDb, t as startServer } from "./server-VlzPosuk.js";
 import { readFileSync } from "node:fs";
 import { execSync, spawnSync } from "node:child_process";
@@ -108,7 +108,7 @@ function runUpgrade(dryRun = false, reExecArgs) {
 	}
 	const alreadyReExeced = process.env["TRAFIC_UPGRADE_REEXEC"] === "1";
 	step("Check for updates");
-	const current = "0.1.25";
+	const current = "0.1.26";
 	info(`Current version: ${current}`);
 	const latest = fetchLatestVersion();
 	if (!latest) warn("Could not reach npm registry — skipping version check");
@@ -187,7 +187,7 @@ function printHelp() {
 	console.log(HELP.trim());
 }
 function printVersion() {
-	console.log("0.1.25");
+	console.log("0.1.26");
 }
 async function runStart(values) {
 	const config = loadConfig(values.config);

package/dist/index.js

@@ -1,3 +1,3 @@
-import { _ as validateConfig, a as printAuditResults, g as parseDuration, h as loadConfig, m as stopIdleProjects, n as setup, o as runAudit, p as startIdleScheduler, t as audit } from "./setup-D61uhYiJ.js";
+import { _ as validateConfig, a as printAuditResults, g as parseDuration, h as loadConfig, m as stopIdleProjects, n as setup, o as runAudit, p as startIdleScheduler, t as audit } from "./setup-4TI2lreq.js";
 import { C as checkAuth, D as parseBearerToken, E as parseBasicAuth, S as watchProjectList, T as matchIp, _ as getProjectInfo, a as cleanOldLogs, b as startProject, c as getDb, d as initDb, f as logAccess, g as getProjectFromHostname, h as buildHostnameIndex, i as shouldNeverStop, l as getIdleProjects, m as updateProjectAccess, n as getIdleTimeoutMs, o as closeDb, p as setProjectStatus, r as loadProjectConfig, s as getAccessLogs, t as startServer, u as getProject, v as listProjects, w as matchHostname, x as stopProject, y as loadProjectList } from "./server-VlzPosuk.js";
 export { audit, buildHostnameIndex, checkAuth, cleanOldLogs, closeDb, getAccessLogs, getDb, getIdleProjects, getIdleTimeoutMs, getProject, getProjectFromHostname, getProjectInfo, initDb, listProjects, loadConfig, loadProjectConfig, loadProjectList, logAccess, matchHostname, matchIp, parseBasicAuth, parseBearerToken, parseDuration, printAuditResults, runAudit, setProjectStatus, setup, shouldNeverStop, startIdleScheduler, startProject, startServer, stopIdleProjects, stopProject, updateProjectAccess, validateConfig, watchProjectList };

package/dist/setup/agent.d.ts

@@ -1,3 +1,4 @@
+import { type SetupIo } from "./io.js";
 /**
  * Add the NodeSource apt repository and GPG key.
  * Idempotent: safe to call even if the repository is already configured.
@@ -5,7 +6,7 @@
  * nodejs.org points at NodeSource for apt installs. The Ubuntu 24.04
  * `nodejs` package is 18.x, far below what the agent needs.
  */
-export declare function addNodeSourceAptRepo(): void;
+export declare function addNodeSourceAptRepo(io?: SetupIo): void;
 /**
  * Install Node.js from the NodeSource apt repository.
  *
@@ -13,17 +14,17 @@ export declare function addNodeSourceAptRepo(): void;
  * trafic-agent` resolves for the systemd unit — and unattended-upgrades
  * patches them, which a version manager install never gets.
  */
-export declare function installNode(): void;
+export declare function installNode(io?: SetupIo): void;
 /**
  * Install the Trafic agent
  */
-export declare function installAgent(): void;
+export declare function installAgent(io?: SetupIo): void;
 /**
  * Create the agent configuration
  */
-export declare function createAgentConfig(tld: string, _email?: string): void;
+export declare function createAgentConfig(tld: string, _email?: string, io?: SetupIo): void;
 /**
  * Create systemd service for the agent
  */
-export declare function createSystemdService(): void;
+export declare function createSystemdService(io?: SetupIo): void;
 //# sourceMappingURL=agent.d.ts.map

package/dist/setup/agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../src/setup/agent.ts"],"names":[],"mappings":"AASA;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAuB3C;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,IAAI,CAqBlC;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,IAAI,CAOnC;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAiDpE;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAkD3C"}
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../src/setup/agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AAS/C;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAuB/D;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAqBtD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAOvD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,MAAM,EACf,EAAE,GAAE,OAAgB,GACnB,IAAI,CAiDN;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAkD/D"}

package/dist/setup/ddev.d.ts

@@ -1,16 +1,17 @@
+import { type SetupIo } from "./io.js";
 /**
  * Install system dependencies required by Trafic
  */
-export declare function installSystemDeps(): void;
+export declare function installSystemDeps(io?: SetupIo): void;
 /**
  * Add the official DDEV apt repository and GPG key.
  * Idempotent: safe to call even if the repository is already configured.
  */
-export declare function addDdevAptRepo(): void;
+export declare function addDdevAptRepo(io?: SetupIo): void;
 /**
  * Install DDEV
  */
-export declare function installDdev(): void;
+export declare function installDdev(io?: SetupIo): void;
 /**
  * Configure DDEV global settings for production
  *
@@ -22,22 +23,22 @@ export declare function installDdev(): void;
  *
  * With proper DNS, DDEV won't need sudo for hostname management.
  */
-export declare function configureDdev(tld: string, email?: string): void;
+export declare function configureDdev(tld: string, email?: string, io?: SetupIo): void;
 /**
  * Install dnsmasq for local DNS resolution (optional)
  * This allows the server itself to resolve *.{tld} hostnames
  * without needing to edit /etc/hosts for each project
  */
-export declare function installDnsmasq(tld: string): void;
+export declare function installDnsmasq(tld: string, io?: SetupIo): void;
 /**
  * Get the Docker gateway IP reachable from inside DDEV containers on Linux.
  * DDEV runs containers on the `ddev_default` network — we inspect that first.
  * Falls back to the default `bridge` network, then to 172.17.0.1.
  * `host.docker.internal` is not available on Linux without extra configuration.
  */
-export declare function getDockerGatewayIp(): string;
+export declare function getDockerGatewayIp(io?: SetupIo): string;
 /**
  * Configure Traefik for forward auth
  */
-export declare function configureTraefik(): void;
+export declare function configureTraefik(io?: SetupIo): void;
 //# sourceMappingURL=ddev.d.ts.map

package/dist/setup/ddev.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ddev.d.ts","sourceRoot":"","sources":["../../src/setup/ddev.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAYxC;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAWrC;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,IAAI,CA2BlC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAsB/D;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAsChD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAc3C;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAkEvC"}
+{"version":3,"file":"ddev.d.ts","sourceRoot":"","sources":["../../src/setup/ddev.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AAG/C;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAY5D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAWzD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CA2BtD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE,MAAM,EACd,EAAE,GAAE,OAAgB,GACnB,IAAI,CAsBN;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,GAAE,OAAgB,GAAG,IAAI,CAsCtE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,GAAE,OAAgB,GAAG,MAAM,CAc/D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAkE3D"}

package/dist/setup/docker.d.ts

@@ -1,13 +1,14 @@
+import { type SetupIo } from "./io.js";
 /**
  * Install Docker using the official script
  */
-export declare function installDocker(): void;
+export declare function installDocker(io?: SetupIo): void;
 /**
  * Configure Docker for production use
  */
-export declare function configureDocker(): void;
+export declare function configureDocker(io?: SetupIo): void;
 /**
  * Setup Docker system prune cron job
  */
-export declare function setupDockerPrune(): void;
+export declare function setupDockerPrune(io?: SetupIo): void;
 //# sourceMappingURL=docker.d.ts.map

package/dist/setup/docker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../src/setup/docker.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,wBAAgB,aAAa,IAAI,IAAI,CAwBpC;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,IAAI,CAqCtC;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAWvC"}
+{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../src/setup/docker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AAG/C;;GAEG;AACH,wBAAgB,aAAa,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAwBxD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAqC1D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAW3D"}

package/dist/setup/hardening.d.ts

@@ -1,29 +1,39 @@
+import { type SetupIo } from "./io.js";
+/**
+ * Resolve the users listed in AllowUsers.
+ *
+ * The user who invoked sudo is always included. Without them, the
+ * AllowUsers directive locks them out on their next connection, and
+ * reloading sshd keeps the current session alive so nothing looks wrong
+ * until it is too late. root needs no entry — it is always listed.
+ */
+export declare function resolveAllowedUsers(allowedUsers: string[], sudoUser: string | undefined): string[];
 /**
  * Configure SSH hardening
  */
-export declare function hardenSsh(allowedUsers?: string[]): void;
+export declare function hardenSsh(allowedUsers?: string[], io?: SetupIo): void;
 /**
  * Configure UFW firewall
  */
-export declare function configureFirewall(): void;
+export declare function configureFirewall(io?: SetupIo): void;
 /**
  * Configure automatic security updates
  */
-export declare function configureUnattendedUpgrades(): void;
+export declare function configureUnattendedUpgrades(io?: SetupIo): void;
 /**
  * Configure Fail2ban
  */
-export declare function configureFail2ban(): void;
+export declare function configureFail2ban(io?: SetupIo): void;
 /**
  * Configure system limits
  */
-export declare function configureSystemLimits(): void;
+export declare function configureSystemLimits(io?: SetupIo): void;
 /**
  * Set proper file permissions
  */
-export declare function configureFilePermissions(): void;
+export declare function configureFilePermissions(io?: SetupIo): void;
 /**
  * Run all hardening steps
  */
-export declare function hardenServer(sshUsers?: string[]): void;
+export declare function hardenServer(sshUsers?: string[], io?: SetupIo): void;
 //# sourceMappingURL=hardening.d.ts.map

package/dist/setup/hardening.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hardening.d.ts","sourceRoot":"","sources":["../../src/setup/hardening.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,wBAAgB,SAAS,CAAC,YAAY,GAAE,MAAM,EAAa,GAAG,IAAI,CAiDjE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAuBxC;AAED;;GAEG;AACH,wBAAgB,2BAA2B,IAAI,IAAI,CA+ClD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAiCxC;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAc5C;AAED;;GAEG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CAuB/C;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,GAAE,MAAM,EAAa,GAAG,IAAI,CAOhE"}
+{"version":3,"file":"hardening.d.ts","sourceRoot":"","sources":["../../src/setup/hardening.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AAG/C;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,MAAM,EAAE,EACtB,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,MAAM,EAAE,CAQV;AAED;;GAEG;AACH,wBAAgB,SAAS,CACvB,YAAY,GAAE,MAAM,EAAa,EACjC,EAAE,GAAE,OAAgB,GACnB,IAAI,CAmDN;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAuB5D;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CA+CtE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAiC5D;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAchE;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAuBnE;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,GAAE,MAAM,EAAa,EAC7B,EAAE,GAAE,OAAgB,GACnB,IAAI,CAON"}

package/dist/setup/io.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The effectful operations the setup steps need.
+ *
+ * Injected into every setup function so tests can drive them with plain
+ * fakes — no module mocking — and so dry-run has one place to intercept
+ * writes instead of each module reaching for `node:fs` itself.
+ */
+export interface SetupIo {
+    /** Run a shell command. Returns its stdout when silent. */
+    exec(command: string, options?: {
+        silent?: boolean;
+    }): string;
+    /** Whether a command is on the PATH. */
+    commandExists(command: string): boolean;
+    /** Write a file. Honours dry-run. */
+    writeFile(path: string, content: string): void;
+    /** Whether a path exists. */
+    fileExists(path: string): boolean;
+    /** Read a UTF-8 file. */
+    readFile(path: string): string;
+    /** Process environment, for values like SUDO_USER. */
+    env: Record<string, string | undefined>;
+}
+/**
+ * The real implementation, used when no io is injected.
+ *
+ * `writeFile` comes from steps.js rather than `node:fs` so writes are
+ * skipped in dry-run mode. Reads stay direct: they change nothing.
+ */
+export declare const nodeIo: SetupIo;
+//# sourceMappingURL=io.d.ts.map

package/dist/setup/io.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"io.d.ts","sourceRoot":"","sources":["../../src/setup/io.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,MAAM,WAAW,OAAO;IACtB,2DAA2D;IAC3D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,MAAM,CAAC;IAC9D,wCAAwC;IACxC,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IACxC,qCAAqC;IACrC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,6BAA6B;IAC7B,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAClC,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CACzC;AAED;;;;;GAKG;AACH,eAAO,MAAM,MAAM,EAAE,OAOpB,CAAC"}

package/dist/setup/user.d.ts

@@ -1,14 +1,15 @@
+import { type SetupIo } from "./io.js";
 /**
  * Write /etc/sudoers.d/trafic-ddev allowing the ddev user to run
  * ddev-hostname without a password. Idempotent — safe to call multiple times.
  */
-export declare function configureDdevSudoers(): void;
+export declare function configureDdevSudoers(io?: SetupIo): void;
 /**
  * Create the ddev user with proper permissions
  */
-export declare function createDdevUser(): void;
+export declare function createDdevUser(io?: SetupIo): void;
 /**
  * Setup authorized_keys for ddev user
  */
-export declare function setupAuthorizedKeys(publicKey?: string): void;
+export declare function setupAuthorizedKeys(publicKey?: string, io?: SetupIo): void;
 //# sourceMappingURL=user.d.ts.map

package/dist/setup/user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/setup/user.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAQ3C;AAED;;GAEG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAiCrC;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAqB5D"}
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/setup/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AAG/C;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAQ/D;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAiCzD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,CAAC,EAAE,MAAM,EAClB,EAAE,GAAE,OAAgB,GACnB,IAAI,CAqBN"}