@studiometa/trafic-agent 0.1.25 → 0.1.27

package/dist/{setup-D61uhYiJ.js → setup-BcY2feHr.js}

@@ -1,4 +1,4 @@
-import { _ as getProjectInfo, i as shouldNeverStop, l as getIdleProjects, n as getIdleTimeoutMs, p as setProjectStatus, r as loadProjectConfig, x as stopProject, y as loadProjectList } from "./server-VlzPosuk.js";
+import { _ as getProjectInfo, i as shouldNeverStop, l as getIdleProjects, n as getIdleTimeoutMs, p as setProjectStatus, r as loadProjectConfig, x as stopProject, y as loadProjectList } from "./server-zVWzPuj2.js";
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { parse } from "smol-toml";
 import { execSync } from "node:child_process";
@@ -21,7 +21,8 @@ var DEFAULT_CONFIG = {
 		allowedIps: [],
 		tokens: [],
 		basicAuth: [],
-		rules: []
+		rules: [],
+		trustedProxyHops: 1
 	}
 };
 /**
@@ -87,10 +88,23 @@ function mergeAuthConfig(raw) {
 			policy: r.policy,
 			tokens: r.tokens,
 			allowedIps: r.allowed_ips
-		}))
+		})),
+		trustedProxyHops: parseTrustedProxyHops(raw.trusted_proxy_hops)
 	};
 }
 /**
+* Parse trusted_proxy_hops, ignoring values that cannot be a hop count.
+*
+* A bad value falls back to the default rather than 0, because 0 would read
+* the socket peer — always the proxy — and quietly stop the IP allowlist and
+* per-hostname IP rules from ever matching.
+*/
+function parseTrustedProxyHops(raw) {
+	const hops = typeof raw === "number" ? raw : Number(raw);
+	if (!Number.isInteger(hops) || hops < 1) return DEFAULT_CONFIG.auth.trustedProxyHops;
+	return hops;
+}
+/**
 * Validate configuration
 */
 function validateConfig(config) {
@@ -237,39 +251,68 @@ function commandExists(command) {
 function isRoot() {
 	return process.getuid?.() === 0;
 }
+/**
+* Write a file (or show in dry-run mode)
+*/
+function writeFile(path, content) {
+	if (dryRun) {
+		console.log(`    \x1b[90mWrite ${path}:\x1b[0m`);
+		const lines = content.split("\n").slice(0, 5);
+		for (const line of lines) console.log(`    \x1b[90m  ${line}\x1b[0m`);
+		if (content.split("\n").length > 5) console.log(`    \x1b[90m  ...\x1b[0m`);
+		return;
+	}
+	writeFileSync(path, content);
+}
+//#endregion
+//#region src/setup/io.ts
+/**
+* The real implementation, used when no io is injected.
+*
+* `writeFile` comes from steps.js rather than `node:fs` so writes are
+* skipped in dry-run mode. Reads stay direct: they change nothing.
+*/
+var nodeIo = {
+	exec,
+	commandExists,
+	writeFile,
+	fileExists: existsSync,
+	readFile: (path) => readFileSync(path, "utf-8"),
+	env: process.env
+};
 //#endregion
 //#region src/setup/user.ts
 /**
 * Write /etc/sudoers.d/trafic-ddev allowing the ddev user to run
 * ddev-hostname without a password. Idempotent — safe to call multiple times.
 */
-function configureDdevSudoers() {
-	writeFileSync("/etc/sudoers.d/trafic-ddev", `# Trafic: allow ddev user to run ddev-hostname without a password.
+function configureDdevSudoers(io = nodeIo) {
+	io.writeFile("/etc/sudoers.d/trafic-ddev", `# Trafic: allow ddev user to run ddev-hostname without a password.
 # ddev-hostname manages /etc/hosts and always calls sudo internally.
 ddev ALL=(ALL) NOPASSWD: /usr/bin/ddev-hostname
 `);
-	exec("chmod 440 /etc/sudoers.d/trafic-ddev", { silent: true });
+	io.exec("chmod 440 /etc/sudoers.d/trafic-ddev", { silent: true });
 	success("Configured passwordless sudo for ddev-hostname");
 }
 /**
 * Create the ddev user with proper permissions
 */
-function createDdevUser() {
+function createDdevUser(io = nodeIo) {
 	step("Create ddev user");
-	if (execSilent$1("id -u ddev 2>/dev/null")) info("User 'ddev' already exists");
+	if (io.exec("id -u ddev 2>/dev/null", { silent: true })) info("User 'ddev' already exists");
 	else {
-		exec("useradd -m -s /bin/bash ddev");
+		io.exec("useradd -m -s /bin/bash ddev");
 		success("Created user 'ddev'");
 	}
-	exec("usermod -aG docker ddev 2>/dev/null || true", { silent: true });
-	exec("mkdir -p /home/ddev/www");
-	exec("chown ddev:ddev /home/ddev/www");
-	exec("chmod 750 /home/ddev/www");
+	io.exec("usermod -aG docker ddev 2>/dev/null || true", { silent: true });
+	io.exec("mkdir -p /home/ddev/www");
+	io.exec("chown ddev:ddev /home/ddev/www");
+	io.exec("chmod 750 /home/ddev/www");
 	success("Created /home/ddev/www");
-	exec("mkdir -p /home/ddev/.ssh");
-	exec("chmod 700 /home/ddev/.ssh");
-	exec("chown ddev:ddev /home/ddev/.ssh");
-	configureDdevSudoers();
+	io.exec("mkdir -p /home/ddev/.ssh");
+	io.exec("chmod 700 /home/ddev/.ssh");
+	io.exec("chown ddev:ddev /home/ddev/.ssh");
+	configureDdevSudoers(io);
 	success("User ddev configured");
 }
 //#endregion
@@ -277,26 +320,26 @@ function createDdevUser() {
 /**
 * Install Docker using the official script
 */
-function installDocker() {
+function installDocker(io = nodeIo) {
 	step("Install Docker");
-	if (commandExists("docker")) {
-		info(`Docker already installed: ${exec("docker --version", { silent: true })?.trim() ?? "unknown version"}`);
+	if (io.commandExists("docker")) {
+		info(`Docker already installed: ${io.exec("docker --version", { silent: true })?.trim() ?? "unknown version"}`);
 		return;
 	}
 	info("Downloading and running Docker install script...");
-	exec("curl -fsSL https://get.docker.com -o /tmp/get-docker.sh");
-	exec("sh /tmp/get-docker.sh", { silent: true });
-	exec("rm /tmp/get-docker.sh");
-	exec("systemctl enable docker", { silent: true });
-	exec("systemctl start docker", { silent: true });
+	io.exec("curl -fsSL https://get.docker.com -o /tmp/get-docker.sh");
+	io.exec("sh /tmp/get-docker.sh", { silent: true });
+	io.exec("rm /tmp/get-docker.sh");
+	io.exec("systemctl enable docker", { silent: true });
+	io.exec("systemctl start docker", { silent: true });
 	success("Docker installed and started");
-	exec("usermod -aG docker ddev", { silent: true });
+	io.exec("usermod -aG docker ddev", { silent: true });
 	success("Added ddev user to docker group");
 }
 /**
 * Configure Docker for production use
 */
-function configureDocker() {
+function configureDocker(io = nodeIo) {
 	step("Configure Docker");
 	const daemonConfig = {
 		"log-driver": "json-file",
@@ -307,32 +350,32 @@ function configureDocker() {
 		"storage-driver": "overlay2",
 		"live-restore": true
 	};
-	exec("mkdir -p /etc/docker");
+	io.exec("mkdir -p /etc/docker");
 	const configPath = "/etc/docker/daemon.json";
-	if (existsSync(configPath)) try {
+	if (io.fileExists(configPath)) try {
 		const merged = {
-			...JSON.parse(readFileSync(configPath, "utf-8")),
+			...JSON.parse(io.readFile(configPath)),
 			...daemonConfig
 		};
-		writeFileSync(configPath, JSON.stringify(merged, null, 2));
+		io.writeFile(configPath, JSON.stringify(merged, null, 2));
 		info("Merged with existing Docker config");
 	} catch {
 		warn("Could not parse existing Docker config, skipping");
 		return;
 	}
-	else writeFileSync(configPath, JSON.stringify(daemonConfig, null, 2));
-	exec("systemctl reload docker || systemctl restart docker");
+	else io.writeFile(configPath, JSON.stringify(daemonConfig, null, 2));
+	io.exec("systemctl reload docker || systemctl restart docker");
 	success("Docker configured with production settings");
 }
 /**
 * Setup Docker system prune cron job
 */
-function setupDockerPrune() {
+function setupDockerPrune(io = nodeIo) {
 	step("Setup Docker cleanup cron");
-	writeFileSync("/etc/cron.d/trafic-docker-prune", `# Trafic: Clean up Docker resources weekly
+	io.writeFile("/etc/cron.d/trafic-docker-prune", `# Trafic: Clean up Docker resources weekly
 0 3 * * 0 root docker system prune -af --volumes 2>&1 | logger -t docker-prune
 `);
-	exec("chmod 644 /etc/cron.d/trafic-docker-prune");
+	io.exec("chmod 644 /etc/cron.d/trafic-docker-prune");
 	success("Docker prune scheduled weekly at 3am on Sundays");
 }
 //#endregion
@@ -340,39 +383,39 @@ function setupDockerPrune() {
 /**
 * Install system dependencies required by Trafic
 */
-function installSystemDeps() {
+function installSystemDeps(io = nodeIo) {
 	step("Install system dependencies");
-	exec("apt-get update -qq", { silent: true });
-	exec("DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y jq curl rsync gnupg ca-certificates", { silent: true });
+	io.exec("apt-get update -qq", { silent: true });
+	io.exec("DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y jq curl rsync gnupg ca-certificates", { silent: true });
 	success("System dependencies installed: jq, curl, rsync, gnupg, ca-certificates");
 }
 /**
 * Add the official DDEV apt repository and GPG key.
 * Idempotent: safe to call even if the repository is already configured.
 */
-function addDdevAptRepo() {
-	exec("install -m 0755 -d /etc/apt/keyrings", { silent: true });
-	exec("curl -fsSL https://pkg.ddev.com/apt/gpg.key | gpg --dearmor | tee /etc/apt/keyrings/ddev.gpg > /dev/null", { silent: true });
-	exec("chmod a+r /etc/apt/keyrings/ddev.gpg", { silent: true });
-	exec("echo \"deb [signed-by=/etc/apt/keyrings/ddev.gpg] https://pkg.ddev.com/apt/ * *\" | tee /etc/apt/sources.list.d/ddev.list > /dev/null", { silent: true });
+function addDdevAptRepo(io = nodeIo) {
+	io.exec("install -m 0755 -d /etc/apt/keyrings", { silent: true });
+	io.exec("curl -fsSL https://pkg.ddev.com/apt/gpg.key | gpg --dearmor | tee /etc/apt/keyrings/ddev.gpg > /dev/null", { silent: true });
+	io.exec("chmod a+r /etc/apt/keyrings/ddev.gpg", { silent: true });
+	io.exec("echo \"deb [signed-by=/etc/apt/keyrings/ddev.gpg] https://pkg.ddev.com/apt/ * *\" | tee /etc/apt/sources.list.d/ddev.list > /dev/null", { silent: true });
 }
 /**
 * Install DDEV
 */
-function installDdev() {
+function installDdev(io = nodeIo) {
 	step("Install DDEV");
-	if (commandExists("ddev")) {
-		info(`DDEV already installed: ${exec("ddev --version 2>/dev/null | head -1", { silent: true })?.trim() ?? "unknown version"}`);
+	if (io.commandExists("ddev")) {
+		info(`DDEV already installed: ${io.exec("ddev --version 2>/dev/null | head -1", { silent: true })?.trim() ?? "unknown version"}`);
 		return;
 	}
 	info("Adding DDEV apt repository...");
-	addDdevAptRepo();
+	addDdevAptRepo(io);
 	info("Installing DDEV...");
-	exec("apt-get update -qq", { silent: true });
-	exec("DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y ddev", { silent: true });
-	exec("HOME=/home/ddev mkcert -install", { silent: true });
-	exec("chown -R ddev:ddev /home/ddev/.local/share/mkcert", { silent: true });
-	success(`DDEV installed: ${exec("ddev --version 2>/dev/null | head -1", { silent: true })?.trim() ?? "unknown version"}`);
+	io.exec("apt-get update -qq", { silent: true });
+	io.exec("DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y ddev", { silent: true });
+	io.exec("HOME=/home/ddev mkcert -install", { silent: true });
+	io.exec("chown -R ddev:ddev /home/ddev/.local/share/mkcert", { silent: true });
+	success(`DDEV installed: ${io.exec("ddev --version 2>/dev/null | head -1", { silent: true })?.trim() ?? "unknown version"}`);
 }
 /**
 * Configure DDEV global settings for production
@@ -385,10 +428,10 @@ function installDdev() {
 *
 * With proper DNS, DDEV won't need sudo for hostname management.
 */
-function configureDdev(tld, email) {
+function configureDdev(tld, email, io = nodeIo) {
 	step("Configure DDEV");
 	const ddevCmd = (cmd) => `su - ddev -c '${cmd}'`;
-	exec(ddevCmd(`ddev config global --project-tld=${tld} --router-http-port=80 --router-https-port=443 --router-bind-all-interfaces=true --use-letsencrypt=${email ? "true" : "false"} ${email ? `--letsencrypt-email=${email}` : ""} --instrumentation-opt-in=false`), { silent: true });
+	io.exec(ddevCmd(`ddev config global --project-tld=${tld} --router-http-port=80 --router-https-port=443 --router-bind-all-interfaces=true --use-letsencrypt=${email ? "true" : "false"} ${email ? `--letsencrypt-email=${email}` : ""} --instrumentation-opt-in=false`), { silent: true });
 	success(`DDEV configured with TLD: ${tld}`);
 	info(`Ensure DNS is configured: *.${tld} → server IP`);
 	if (email) success(`Let's Encrypt enabled with email: ${email}`);
@@ -400,19 +443,19 @@ function configureDdev(tld, email) {
 * Falls back to the default `bridge` network, then to 172.17.0.1.
 * `host.docker.internal` is not available on Linux without extra configuration.
 */
-function getDockerGatewayIp() {
-	const ddevIp = exec("docker network inspect ddev_default --format '{{range .IPAM.Config}}{{.Gateway}}{{end}}' 2>/dev/null", { silent: true })?.trim();
+function getDockerGatewayIp(io = nodeIo) {
+	const ddevIp = io.exec("docker network inspect ddev_default --format '{{range .IPAM.Config}}{{.Gateway}}{{end}}' 2>/dev/null", { silent: true })?.trim();
 	if (ddevIp) return ddevIp;
-	return exec("docker network inspect bridge --format '{{range .IPAM.Config}}{{.Gateway}}{{end}}' 2>/dev/null", { silent: true })?.trim() || "172.17.0.1";
+	return io.exec("docker network inspect bridge --format '{{range .IPAM.Config}}{{.Gateway}}{{end}}' 2>/dev/null", { silent: true })?.trim() || "172.17.0.1";
 }
 /**
 * Configure Traefik for forward auth
 */
-function configureTraefik() {
+function configureTraefik(io = nodeIo) {
 	step("Configure Traefik for forward auth");
-	exec("mkdir -p /home/ddev/.ddev/traefik/custom-global-config", { silent: true });
-	exec("chown -R ddev:ddev /home/ddev/.ddev", { silent: true });
-	const gatewayIp = getDockerGatewayIp();
+	io.exec("mkdir -p /home/ddev/.ddev/traefik/custom-global-config", { silent: true });
+	io.exec("chown -R ddev:ddev /home/ddev/.ddev", { silent: true });
+	const gatewayIp = getDockerGatewayIp(io);
 	const dynamicConfig = `# Trafic: Forward auth middleware definition
 http:
   middlewares:
@@ -436,11 +479,11 @@ http:
         servers:
           - url: "http://${gatewayIp}:9876"
 `;
-	writeFileSync("/home/ddev/.ddev/traefik/trafic.yaml", dynamicConfig);
-	exec("chown ddev:ddev /home/ddev/.ddev/traefik/trafic.yaml", { silent: true });
-	writeFileSync("/home/ddev/.ddev/traefik/custom-global-config/trafic.yaml", dynamicConfig);
-	exec("chown ddev:ddev /home/ddev/.ddev/traefik/custom-global-config/trafic.yaml", { silent: true });
-	writeFileSync("/home/ddev/.ddev/traefik/static_config.trafic.yaml", `entryPoints:
+	io.writeFile("/home/ddev/.ddev/traefik/trafic.yaml", dynamicConfig);
+	io.exec("chown ddev:ddev /home/ddev/.ddev/traefik/trafic.yaml", { silent: true });
+	io.writeFile("/home/ddev/.ddev/traefik/custom-global-config/trafic.yaml", dynamicConfig);
+	io.exec("chown ddev:ddev /home/ddev/.ddev/traefik/custom-global-config/trafic.yaml", { silent: true });
+	io.writeFile("/home/ddev/.ddev/traefik/static_config.trafic.yaml", `entryPoints:
   http-80:
     http:
       middlewares:
@@ -452,7 +495,7 @@ http:
         - trafic-auth@file
         - trafic-errors@file
 `);
-	exec("chown ddev:ddev /home/ddev/.ddev/traefik/static_config.trafic.yaml", { silent: true });
+	io.exec("chown ddev:ddev /home/ddev/.ddev/traefik/static_config.trafic.yaml", { silent: true });
 	success("Traefik configured with Trafic middleware");
 }
 //#endregion
@@ -468,13 +511,13 @@ var NODESOURCE_KEYRING = "/etc/apt/keyrings/nodesource.gpg";
 * nodejs.org points at NodeSource for apt installs. The Ubuntu 24.04
 * `nodejs` package is 18.x, far below what the agent needs.
 */
-function addNodeSourceAptRepo() {
-	exec("install -m 0755 -d /etc/apt/keyrings", { silent: true });
-	exec("curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key -o /tmp/trafic-nodesource.key", { silent: true });
-	exec("gpg --batch --yes --dearmor -o /tmp/trafic-nodesource.gpg /tmp/trafic-nodesource.key", { silent: true });
-	exec(`install -m 0644 /tmp/trafic-nodesource.gpg ${NODESOURCE_KEYRING}`, { silent: true });
-	exec("rm -f /tmp/trafic-nodesource.key /tmp/trafic-nodesource.gpg", { silent: true });
-	exec(`echo "deb [signed-by=${NODESOURCE_KEYRING}] https://deb.nodesource.com/node_${NODE_MAJOR}.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list > /dev/null`, { silent: true });
+function addNodeSourceAptRepo(io = nodeIo) {
+	io.exec("install -m 0755 -d /etc/apt/keyrings", { silent: true });
+	io.exec("curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key -o /tmp/trafic-nodesource.key", { silent: true });
+	io.exec("gpg --batch --yes --dearmor -o /tmp/trafic-nodesource.gpg /tmp/trafic-nodesource.key", { silent: true });
+	io.exec(`install -m 0644 /tmp/trafic-nodesource.gpg ${NODESOURCE_KEYRING}`, { silent: true });
+	io.exec("rm -f /tmp/trafic-nodesource.key /tmp/trafic-nodesource.gpg", { silent: true });
+	io.exec(`echo "deb [signed-by=${NODESOURCE_KEYRING}] https://deb.nodesource.com/node_${NODE_MAJOR}.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list > /dev/null`, { silent: true });
 }
 /**
 * Install Node.js from the NodeSource apt repository.
@@ -483,37 +526,38 @@ function addNodeSourceAptRepo() {
 * trafic-agent` resolves for the systemd unit — and unattended-upgrades
 * patches them, which a version manager install never gets.
 */
-function installNode() {
+function installNode(io = nodeIo) {
 	step("Install Node.js");
-	if (commandExists("node")) {
-		info(`Node.js already installed: ${exec("node --version", { silent: true })?.trim()}`);
+	if (io.commandExists("node")) {
+		info(`Node.js already installed: ${io.exec("node --version", { silent: true })?.trim()}`);
 		return;
 	}
 	info("Adding NodeSource apt repository...");
-	addNodeSourceAptRepo();
+	addNodeSourceAptRepo(io);
 	info("Installing Node.js...");
-	exec("apt-get update -qq", { silent: true });
-	exec("DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y nodejs", { silent: true });
+	io.exec("apt-get update -qq", { silent: true });
+	io.exec("DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y nodejs", { silent: true });
 	success(`Node.js ${NODE_MAJOR} installed from apt`);
 }
 /**
 * Install the Trafic agent
 */
-function installAgent() {
+function installAgent(io = nodeIo) {
 	step("Install Trafic agent");
-	exec("npm install -g @studiometa/trafic-agent");
+	io.exec("npm install -g @studiometa/trafic-agent");
 	success("Trafic agent installed");
 }
 /**
 * Create the agent configuration
 */
-function createAgentConfig(tld, _email) {
+function createAgentConfig(options, io = nodeIo) {
+	const { tld, trustedProxyHops = 1 } = options;
 	step("Create agent configuration");
-	exec("mkdir -p /etc/trafic");
-	exec("mkdir -p /var/lib/trafic");
-	exec("chown ddev:ddev /var/lib/trafic");
+	io.exec("mkdir -p /etc/trafic");
+	io.exec("mkdir -p /var/lib/trafic");
+	io.exec("chown ddev:ddev /var/lib/trafic");
 	const configPath = "/etc/trafic/config.toml";
-	if (existsSync(configPath)) {
+	if (io.fileExists(configPath)) {
 		info("Configuration already exists at /etc/trafic/config.toml — skipping");
 		info("Edit this file to configure authentication");
 		return;
@@ -543,17 +587,24 @@ allowed_ips = []
 tokens = []
 basic_auth = []
 rules = []
+
+# Proxies in front of the agent, counted so the client address can be read
+# from X-Forwarded-For. 1 is ddev-router/Traefik alone. Raise it by one for
+# every extra proxy — a CDN or load balancer ahead of Traefik makes it 2.
+# Too low and allowed_ips matches a proxy instead of the client; too high and
+# it can be spoofed by a client-supplied header.
+trusted_proxy_hops = ${trustedProxyHops}
 `;
-	writeFileSync(configPath, config);
-	exec("chmod 640 /etc/trafic/config.toml");
-	exec("chown root:ddev /etc/trafic/config.toml");
+	io.writeFile(configPath, config);
+	io.exec("chmod 640 /etc/trafic/config.toml");
+	io.exec("chown root:ddev /etc/trafic/config.toml");
 	success("Configuration created at /etc/trafic/config.toml");
 	info("Edit this file to configure authentication");
 }
 /**
 * Create systemd service for the agent
 */
-function createSystemdService() {
+function createSystemdService(io = nodeIo) {
 	step("Create systemd service");
 	const serviceContent = `[Unit]
 Description=Trafic Agent - DDEV preview environment manager
@@ -564,7 +615,7 @@ Requires=docker.service
 Type=simple
 User=ddev
 Group=ddev
-ExecStart=${exec("which trafic-agent", { silent: true })?.trim() || "/usr/bin/trafic-agent"} start --config /etc/trafic/config.toml
+ExecStart=${io.exec("which trafic-agent", { silent: true })?.trim() || "/usr/bin/trafic-agent"} start --config /etc/trafic/config.toml
 Restart=always
 RestartSec=5
 StandardOutput=journal
@@ -588,21 +639,35 @@ PrivateTmp=true
 [Install]
 WantedBy=multi-user.target
 `;
-	writeFileSync("/etc/systemd/system/trafic-agent.service", serviceContent);
-	exec("chmod 644 /etc/systemd/system/trafic-agent.service");
-	exec("systemctl daemon-reload");
-	exec("systemctl enable trafic-agent");
-	exec("systemctl start trafic-agent");
+	io.writeFile("/etc/systemd/system/trafic-agent.service", serviceContent);
+	io.exec("chmod 644 /etc/systemd/system/trafic-agent.service");
+	io.exec("systemctl daemon-reload");
+	io.exec("systemctl enable trafic-agent");
+	io.exec("systemctl start trafic-agent");
 	success("Trafic agent service started");
 	info("View logs: journalctl -u trafic-agent -f");
 }
 //#endregion
 //#region src/setup/hardening.ts
 /**
+* Resolve the users listed in AllowUsers.
+*
+* The user who invoked sudo is always included. Without them, the
+* AllowUsers directive locks them out on their next connection, and
+* reloading sshd keeps the current session alive so nothing looks wrong
+* until it is too late. root needs no entry — it is always listed.
+*/
+function resolveAllowedUsers(allowedUsers, sudoUser) {
+	const users = allowedUsers.map((user) => user.trim()).filter(Boolean);
+	if (sudoUser && sudoUser !== "root" && !users.includes(sudoUser)) users.push(sudoUser);
+	return users;
+}
+/**
 * Configure SSH hardening
 */
-function hardenSsh(allowedUsers = ["ddev"]) {
+function hardenSsh(allowedUsers = ["ddev"], io = nodeIo) {
 	step("Harden SSH configuration");
+	const users = resolveAllowedUsers(allowedUsers, io.env.SUDO_USER);
 	const sshConfig = `# Trafic SSH hardening
 # Generated by trafic setup
 
@@ -621,7 +686,7 @@ ClientAliveInterval 300
 ClientAliveCountMax 2
 
 # Allowed users (root kept for emergency access)
-AllowUsers root ${allowedUsers.join(" ")}
+AllowUsers root ${users.join(" ")}
 
 # Disable X11 forwarding
 X11Forwarding no
@@ -634,40 +699,40 @@ KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
 Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com
 MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
 `;
-	writeFileSync("/etc/ssh/sshd_config.d/trafic.conf", sshConfig);
-	exec("chmod 644 /etc/ssh/sshd_config.d/trafic.conf");
-	if (exec("sshd -t 2>&1 || echo 'error'", { silent: true })?.includes("error")) {
+	io.writeFile("/etc/ssh/sshd_config.d/trafic.conf", sshConfig);
+	io.exec("chmod 644 /etc/ssh/sshd_config.d/trafic.conf");
+	if (io.exec("sshd -t 2>&1 || echo 'error'", { silent: true })?.includes("error")) {
 		warn("SSH config test failed, reverting...");
-		exec("rm /etc/ssh/sshd_config.d/trafic.conf");
+		io.exec("rm /etc/ssh/sshd_config.d/trafic.conf");
 		return;
 	}
-	exec("systemctl reload ssh || systemctl reload sshd");
+	io.exec("systemctl reload ssh || systemctl reload sshd");
 	success("SSH hardened: password auth disabled, root key-only login retained");
-	info(`Allowed users: root, ${allowedUsers.join(", ")}`);
+	info(`Allowed users: root, ${users.join(", ")}`);
 }
 /**
 * Configure UFW firewall
 */
-function configureFirewall() {
+function configureFirewall(io = nodeIo) {
 	step("Configure firewall (UFW)");
-	if (!commandExists("ufw")) exec("DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y ufw", { silent: true });
-	exec("ufw --force reset", { silent: true });
-	exec("ufw default deny incoming");
-	exec("ufw default allow outgoing");
-	exec("ufw allow 22/tcp comment 'SSH'");
-	exec("ufw allow 80/tcp comment 'HTTP'");
-	exec("ufw allow 443/tcp comment 'HTTPS'");
-	exec("ufw allow from 172.16.0.0/12 to any port 9876 comment 'trafic-agent from Docker'");
-	exec("ufw --force enable");
+	if (!io.commandExists("ufw")) io.exec("DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y ufw", { silent: true });
+	io.exec("ufw --force reset", { silent: true });
+	io.exec("ufw default deny incoming");
+	io.exec("ufw default allow outgoing");
+	io.exec("ufw allow 22/tcp comment 'SSH'");
+	io.exec("ufw allow 80/tcp comment 'HTTP'");
+	io.exec("ufw allow 443/tcp comment 'HTTPS'");
+	io.exec("ufw allow from 172.16.0.0/12 to any port 9876 comment 'trafic-agent from Docker'");
+	io.exec("ufw --force enable");
 	success("Firewall enabled: SSH (22), HTTP (80), HTTPS (443), trafic-agent (9876 from Docker) allowed");
 }
 /**
 * Configure automatic security updates
 */
-function configureUnattendedUpgrades() {
+function configureUnattendedUpgrades(io = nodeIo) {
 	step("Configure automatic security updates");
-	exec("DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y unattended-upgrades apt-listchanges", { silent: true });
-	writeFileSync("/etc/apt/apt.conf.d/50unattended-upgrades", `// Trafic: Automatic security updates
+	io.exec("DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y unattended-upgrades apt-listchanges", { silent: true });
+	io.writeFile("/etc/apt/apt.conf.d/50unattended-upgrades", `// Trafic: Automatic security updates
 Unattended-Upgrade::Allowed-Origins {
     "\${distro_id}:\${distro_codename}";
     "\${distro_id}:\${distro_codename}-security";
@@ -684,22 +749,22 @@ Unattended-Upgrade::Remove-Unused-Dependencies "true";
 // Email notifications (optional)
 // Unattended-Upgrade::Mail "root";
 `);
-	writeFileSync("/etc/apt/apt.conf.d/20auto-upgrades", `APT::Periodic::Update-Package-Lists "1";
+	io.writeFile("/etc/apt/apt.conf.d/20auto-upgrades", `APT::Periodic::Update-Package-Lists "1";
 APT::Periodic::Download-Upgradeable-Packages "1";
 APT::Periodic::AutocleanInterval "7";
 APT::Periodic::Unattended-Upgrade "1";
 `);
-	exec("systemctl enable unattended-upgrades");
-	exec("systemctl start unattended-upgrades");
+	io.exec("systemctl enable unattended-upgrades");
+	io.exec("systemctl start unattended-upgrades");
 	success("Automatic security updates enabled");
 }
 /**
 * Configure Fail2ban
 */
-function configureFail2ban() {
+function configureFail2ban(io = nodeIo) {
 	step("Configure Fail2ban");
-	if (!commandExists("fail2ban-client")) exec("DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y fail2ban", { silent: true });
-	writeFileSync("/etc/fail2ban/jail.local", `# Trafic: Fail2ban configuration
+	if (!io.commandExists("fail2ban-client")) io.exec("DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y fail2ban", { silent: true });
+	io.writeFile("/etc/fail2ban/jail.local", `# Trafic: Fail2ban configuration
 [DEFAULT]
 bantime = 3600
 findtime = 600
@@ -714,55 +779,55 @@ logpath = /var/log/auth.log
 maxretry = 3
 bantime = 7200
 `);
-	exec("chmod 644 /etc/fail2ban/jail.local");
-	exec("systemctl enable fail2ban");
-	exec("systemctl restart fail2ban");
+	io.exec("chmod 644 /etc/fail2ban/jail.local");
+	io.exec("systemctl enable fail2ban");
+	io.exec("systemctl restart fail2ban");
 	success("Fail2ban enabled: SSH brute force protection active");
 }
 /**
 * Configure system limits
 */
-function configureSystemLimits() {
+function configureSystemLimits(io = nodeIo) {
 	step("Configure system limits");
-	writeFileSync("/etc/security/limits.d/trafic.conf", `# Trafic: System limits for ddev user
+	io.writeFile("/etc/security/limits.d/trafic.conf", `# Trafic: System limits for ddev user
 ddev soft nofile 65536
 ddev hard nofile 65536
 ddev soft nproc 4096
 ddev hard nproc 4096
 `);
-	exec("chmod 644 /etc/security/limits.d/trafic.conf");
+	io.exec("chmod 644 /etc/security/limits.d/trafic.conf");
 	success("System limits configured for ddev user");
 }
 /**
 * Set proper file permissions
 */
-function configureFilePermissions() {
+function configureFilePermissions(io = nodeIo) {
 	step("Configure file permissions");
-	exec("mkdir -p /etc/trafic");
-	exec("mkdir -p /var/lib/trafic");
-	exec("mkdir -p /var/backups/trafic");
-	exec("chmod 755 /etc/trafic");
-	exec("chmod 700 /var/lib/trafic");
-	exec("chmod 700 /var/backups/trafic");
-	exec("chown root:ddev /etc/trafic");
-	exec("chown ddev:ddev /var/lib/trafic");
-	exec("chown ddev:ddev /var/backups/trafic");
-	if (existsSync("/etc/trafic/config.toml")) {
-		exec("chmod 640 /etc/trafic/config.toml");
-		exec("chown root:ddev /etc/trafic/config.toml");
+	io.exec("mkdir -p /etc/trafic");
+	io.exec("mkdir -p /var/lib/trafic");
+	io.exec("mkdir -p /var/backups/trafic");
+	io.exec("chmod 755 /etc/trafic");
+	io.exec("chmod 700 /var/lib/trafic");
+	io.exec("chmod 700 /var/backups/trafic");
+	io.exec("chown root:ddev /etc/trafic");
+	io.exec("chown ddev:ddev /var/lib/trafic");
+	io.exec("chown ddev:ddev /var/backups/trafic");
+	if (io.fileExists("/etc/trafic/config.toml")) {
+		io.exec("chmod 640 /etc/trafic/config.toml");
+		io.exec("chown root:ddev /etc/trafic/config.toml");
 	}
 	success("File permissions configured");
 }
 /**
 * Run all hardening steps
 */
-function hardenServer(sshUsers = ["ddev"]) {
-	hardenSsh(sshUsers);
-	configureFirewall();
-	configureUnattendedUpgrades();
-	configureFail2ban();
-	configureSystemLimits();
-	configureFilePermissions();
+function hardenServer(sshUsers = ["ddev"], io = nodeIo) {
+	hardenSsh(sshUsers, io);
+	configureFirewall(io);
+	configureUnattendedUpgrades(io);
+	configureFail2ban(io);
+	configureSystemLimits(io);
+	configureFilePermissions(io);
 }
 //#endregion
 //#region src/setup/audit.ts
@@ -1309,7 +1374,10 @@ async function setup(options) {
 		}
 		installNode();
 		installAgent();
-		createAgentConfig(options.tld, options.email);
+		createAgentConfig({
+			tld: options.tld,
+			trustedProxyHops: options.trustedProxyHops
+		});
 		createSystemdService();
 		if (!options.noHardening) hardenServer(options.sshUsers ?? ["ddev"]);
 		else {
@@ -1340,4 +1408,4 @@ async function audit() {
 //#endregion
 export { validateConfig as _, printAuditResults as a, info as c, success as d, warn as f, parseDuration as g, loadConfig as h, runPendingMigrations as i, isRoot as l, stopIdleProjects as m, setup as n, runAudit as o, startIdleScheduler as p, listMigrations as r, exec as s, audit as t, step as u };
 
-//# sourceMappingURL=setup-D61uhYiJ.js.map
+//# sourceMappingURL=setup-BcY2feHr.js.map