@studiometa/trafic-agent 0.1.30 → 0.1.32

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { _ as validateConfig, c as info, d as success, f as warn, h as loadConfig, i as runPendingMigrations, l as isRoot, n as setup, p as startIdleScheduler, r as listMigrations, s as exec, t as audit, u as step } from "./setup-DXihIjv9.js";
-import { o as closeDb, t as startServer } from "./server-zVWzPuj2.js";
+import { d as validateConfig, i as runPendingMigrations, l as loadConfig, n as setup, r as listMigrations, s as startIdleScheduler, t as audit } from "./setup-vg_pqnPs.js";
+import { _ as step, d as exec, m as isRoot, n as startServer, p as info, v as success, w as closeDb, y as warn } from "./server-BgOOBUhR.js";
 import { readFileSync } from "node:fs";
 import { execSync, spawnSync } from "node:child_process";
 import { parseArgs } from "node:util";
@@ -108,7 +108,7 @@ function runUpgrade(dryRun = false, reExecArgs) {
 	}
 	const alreadyReExeced = process.env["TRAFIC_UPGRADE_REEXEC"] === "1";
 	step("Check for updates");
-	const current = "0.1.30";
+	const current = "0.1.32";
 	info(`Current version: ${current}`);
 	const latest = fetchLatestVersion();
 	if (!latest) warn("Could not reach npm registry — skipping version check");
@@ -191,7 +191,7 @@ function printHelp() {
 	console.log(HELP.trim());
 }
 function printVersion() {
-	console.log("0.1.30");
+	console.log("0.1.32");
 }
 async function runStart(values) {
 	const config = loadConfig(values.config);

package/dist/index.js

@@ -1,3 +1,3 @@
-import { _ as validateConfig, a as printAuditResults, g as parseDuration, h as loadConfig, m as stopIdleProjects, n as setup, o as runAudit, p as startIdleScheduler, t as audit } from "./setup-DXihIjv9.js";
-import { C as checkAuth, D as parseBearerToken, E as parseBasicAuth, S as watchProjectList, T as matchIp, _ as getProjectInfo, a as cleanOldLogs, b as startProject, c as getDb, d as initDb, f as logAccess, g as getProjectFromHostname, h as buildHostnameIndex, i as shouldNeverStop, l as getIdleProjects, m as updateProjectAccess, n as getIdleTimeoutMs, o as closeDb, p as setProjectStatus, r as loadProjectConfig, s as getAccessLogs, t as startServer, u as getProject, v as listProjects, w as matchHostname, x as stopProject, y as loadProjectList } from "./server-zVWzPuj2.js";
+import { a as printAuditResults, c as stopIdleProjects, d as validateConfig, l as loadConfig, n as setup, o as runAudit, s as startIdleScheduler, t as audit, u as parseDuration } from "./setup-vg_pqnPs.js";
+import { A as logAccess, B as watchProjectList, C as cleanOldLogs, D as getIdleProjects, E as getDb, F as getProjectInfo, G as parseBearerToken, H as matchHostname, I as listProjects, L as loadProjectList, M as updateProjectAccess, N as buildHostnameIndex, O as getProject, P as getProjectFromHostname, R as startProject, S as shouldNeverStop, T as getAccessLogs, U as matchIp, V as checkAuth, W as parseBasicAuth, b as getIdleTimeoutMs, j as setProjectStatus, k as initDb, n as startServer, w as closeDb, x as loadProjectConfig, z as stopProject } from "./server-BgOOBUhR.js";
 export { audit, buildHostnameIndex, checkAuth, cleanOldLogs, closeDb, getAccessLogs, getDb, getIdleProjects, getIdleTimeoutMs, getProject, getProjectFromHostname, getProjectInfo, initDb, listProjects, loadConfig, loadProjectConfig, loadProjectList, logAccess, matchHostname, matchIp, parseBasicAuth, parseBearerToken, parseDuration, printAuditResults, runAudit, setProjectStatus, setup, shouldNeverStop, startIdleScheduler, startProject, startServer, stopIdleProjects, stopProject, updateProjectAccess, validateConfig, watchProjectList };

package/dist/{server-zVWzPuj2.js → server-BgOOBUhR.js}

@@ -1,4 +1,4 @@
-import { existsSync, readFileSync, watch } from "node:fs";
+import { existsSync, readFileSync, watch, writeFileSync } from "node:fs";
 import { execSync } from "node:child_process";
 import { DatabaseSync } from "node:sqlite";
 import { dirname, join, resolve } from "node:path";
@@ -224,29 +224,49 @@ function applyDefaultPolicy(config, ip, authorization) {
 }
 //#endregion
 //#region src/utils/ddev.ts
-function parseSimpleYaml$1(content) {
-	const result = {};
-	const lines = content.split("\n");
-	for (const line of lines) {
-		const trimmed = line.trim();
-		if (!trimmed || trimmed.startsWith("#")) continue;
-		const colonIndex = trimmed.indexOf(":");
-		if (colonIndex === -1) continue;
-		const key = trimmed.slice(0, colonIndex).trim();
-		let value = trimmed.slice(colonIndex + 1).trim();
-		if (value.startsWith("\"") && value.endsWith("\"") || value.startsWith("'") && value.endsWith("'")) value = value.slice(1, -1);
-		result[key] = value;
-	}
-	return result;
+/** Strip a single pair of surrounding quotes. */
+function unquote(value) {
+	if (value.startsWith("\"") && value.endsWith("\"") || value.startsWith("'") && value.endsWith("'")) return value.slice(1, -1);
+	return value;
 }
+/** A project name at the start of a line, e.g. `my-project:` */
+var PROJECT_LINE = /^(\S[^:]*):\s*$/;
+/** An indented `approot: /path` belonging to the project above it */
+var APPROOT_LINE = /^\s+approot:\s*(.+?)\s*$/;
 /**
 * Load projects from DDEV's project_list.yaml
 * Returns a map of project name -> app root path
+*
+* The file nests the path under the project name:
+*
+*   scalian:
+*       approot: /home/ddev/www/scalian
+*
+* Indentation therefore has to be read. A flat key/value pass produces one
+* entry per line instead: the project mapped to an empty string, plus a
+* phantom project called `approot`. Both did damage — the empty path meant
+* `loadProjectConfig` looked for `.ddev/config.trafic.yaml` relative to the
+* working directory and never found it, so per-project settings were silently
+* ignored, and the phantom entered the hostname index, where the TLS ask
+* endpoint would vouch for `approot.<tld>` and have a certificate issued for
+* a project that does not exist.
 */
 function loadProjectList(projectListPath) {
 	if (!existsSync(projectListPath)) return /* @__PURE__ */ new Map();
-	const parsed = parseSimpleYaml$1(readFileSync(projectListPath, "utf-8"));
-	return new Map(Object.entries(parsed));
+	const projects = /* @__PURE__ */ new Map();
+	let current;
+	for (const line of readFileSync(projectListPath, "utf-8").split("\n")) {
+		if (!line.trim() || line.trimStart().startsWith("#")) continue;
+		const project = PROJECT_LINE.exec(line);
+		if (project) {
+			current = unquote(project[1].trim());
+			projects.set(current, "");
+			continue;
+		}
+		const approot = APPROOT_LINE.exec(line);
+		if (approot && current) projects.set(current, unquote(approot[1]));
+	}
+	return projects;
 }
 /**
 * Build a hostname -> project name index
@@ -536,6 +556,363 @@ function getIdleTimeoutMs(config) {
 	return ms > 0 ? ms : void 0;
 }
 //#endregion
+//#region src/setup/steps.ts
+var stepNumber = 0;
+var dryRun = false;
+/**
+* Set dry-run mode
+*/
+function setDryRun(value) {
+	dryRun = value;
+}
+/**
+* Reset step counter
+*/
+function resetSteps() {
+	stepNumber = 0;
+}
+/**
+* Log a step
+*/
+function step(message) {
+	stepNumber++;
+	console.log(`\n\x1b[36m[${stepNumber}]\x1b[0m ${message}`);
+}
+/**
+* Log success
+*/
+function success(message) {
+	console.log(`    \x1b[32m✓\x1b[0m ${message}`);
+}
+/**
+* Log warning
+*/
+function warn(message) {
+	console.log(`    \x1b[33m⚠\x1b[0m ${message}`);
+}
+/**
+* Log error
+*/
+function error(message) {
+	console.log(`    \x1b[31m✗\x1b[0m ${message}`);
+}
+/**
+* Log info
+*/
+function info(message) {
+	console.log(`    ${message}`);
+}
+/**
+* Execute a command (or show in dry-run mode)
+*/
+function exec(command, options) {
+	if (dryRun) {
+		if (!options?.silent) console.log(`    \x1b[90m$ ${command}\x1b[0m`);
+		return "";
+	}
+	try {
+		return execSync(command, {
+			encoding: "utf-8",
+			stdio: options?.silent ? "pipe" : "inherit"
+		});
+	} catch (err) {
+		throw new Error(`Command failed: ${command}\n${err.stderr ?? ""}`);
+	}
+}
+/**
+* Execute a command and return output (silent)
+*/
+function execSilent(command) {
+	if (dryRun) return "";
+	try {
+		return execSync(command, {
+			encoding: "utf-8",
+			stdio: "pipe"
+		}).trim();
+	} catch {
+		return "";
+	}
+}
+/**
+* Check if a command exists
+*/
+function commandExists(command) {
+	try {
+		execSync(`which ${command}`, { stdio: "pipe" });
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Check if running as root
+*/
+function isRoot() {
+	return process.getuid?.() === 0;
+}
+/**
+* Write a file (or show in dry-run mode)
+*/
+function writeFile(path, content) {
+	if (dryRun) {
+		console.log(`    \x1b[90mWrite ${path}:\x1b[0m`);
+		const lines = content.split("\n").slice(0, 5);
+		for (const line of lines) console.log(`    \x1b[90m  ${line}\x1b[0m`);
+		if (content.split("\n").length > 5) console.log(`    \x1b[90m  ...\x1b[0m`);
+		return;
+	}
+	writeFileSync(path, content);
+}
+//#endregion
+//#region src/setup/io.ts
+/**
+* The real implementation, used when no io is injected.
+*
+* `writeFile` comes from steps.js rather than `node:fs` so writes are
+* skipped in dry-run mode. Reads stay direct: they change nothing.
+*/
+var nodeIo = {
+	exec,
+	execSilent,
+	commandExists,
+	writeFile,
+	fileExists: existsSync,
+	readFile: (path) => readFileSync(path, "utf-8"),
+	env: process.env
+};
+//#endregion
+//#region src/setup/ddev.ts
+/**
+* Install system dependencies required by Trafic
+*/
+function installSystemDeps(io = nodeIo) {
+	step("Install system dependencies");
+	io.exec("apt-get update -qq", { silent: true });
+	io.exec("DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y jq curl rsync gnupg ca-certificates", { silent: true });
+	success("System dependencies installed: jq, curl, rsync, gnupg, ca-certificates");
+}
+/**
+* Add the official DDEV apt repository and GPG key.
+* Idempotent: safe to call even if the repository is already configured.
+*/
+function addDdevAptRepo(io = nodeIo) {
+	io.exec("install -m 0755 -d /etc/apt/keyrings", { silent: true });
+	io.exec("curl -fsSL https://pkg.ddev.com/apt/gpg.key | gpg --dearmor | tee /etc/apt/keyrings/ddev.gpg > /dev/null", { silent: true });
+	io.exec("chmod a+r /etc/apt/keyrings/ddev.gpg", { silent: true });
+	io.exec("echo \"deb [signed-by=/etc/apt/keyrings/ddev.gpg] https://pkg.ddev.com/apt/ * *\" | tee /etc/apt/sources.list.d/ddev.list > /dev/null", { silent: true });
+}
+/**
+* Install DDEV
+*/
+function installDdev(io = nodeIo) {
+	step("Install DDEV");
+	if (io.commandExists("ddev")) {
+		info(`DDEV already installed: ${io.exec("ddev --version 2>/dev/null | head -1", { silent: true })?.trim() ?? "unknown version"}`);
+		return;
+	}
+	info("Adding DDEV apt repository...");
+	addDdevAptRepo(io);
+	info("Installing DDEV...");
+	io.exec("apt-get update -qq", { silent: true });
+	io.exec("DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y ddev", { silent: true });
+	io.exec("HOME=/home/ddev mkcert -install", { silent: true });
+	io.exec("chown -R ddev:ddev /home/ddev/.local/share/mkcert", { silent: true });
+	success(`DDEV installed: ${io.exec("ddev --version 2>/dev/null | head -1", { silent: true })?.trim() ?? "unknown version"}`);
+}
+/**
+* Configure DDEV global settings for production
+*
+* Note on DNS and /etc/hosts:
+* When using a custom TLD (not ddev.site), DDEV may try to edit /etc/hosts
+* if it can't resolve project hostnames via DNS. To avoid this:
+* 1. Configure DNS so *.{tld} resolves to the server's IP (recommended)
+* 2. Or install dnsmasq for local wildcard DNS resolution
+*
+* With proper DNS, DDEV won't need sudo for hostname management.
+*/
+function configureDdev(tld, email, io = nodeIo) {
+	step("Configure DDEV");
+	const ddevCmd = (cmd) => `su - ddev -c '${cmd}'`;
+	io.exec(ddevCmd(`ddev config global --project-tld=${tld} --router-http-port=80 --router-https-port=443 --router-bind-all-interfaces=true --use-letsencrypt=${email ? "true" : "false"} ${email ? `--letsencrypt-email=${email}` : ""} --instrumentation-opt-in=false`), { silent: true });
+	success(`DDEV configured with TLD: ${tld}`);
+	info(`Ensure DNS is configured: *.${tld} → server IP`);
+	if (email) success(`Let's Encrypt enabled with email: ${email}`);
+	success("DDEV global settings configured");
+}
+/**
+* Get the Docker gateway IP reachable from inside DDEV containers on Linux.
+* DDEV runs containers on the `ddev_default` network — we inspect that first.
+* Falls back to the default `bridge` network, then to 172.17.0.1.
+* `host.docker.internal` is not available on Linux without extra configuration.
+*/
+function getDockerGatewayIp(io = nodeIo) {
+	const ddevIp = io.execSilent("docker network inspect ddev_default --format '{{range .IPAM.Config}}{{.Gateway}}{{end}}'");
+	if (ddevIp) return ddevIp;
+	return io.execSilent("docker network inspect bridge --format '{{range .IPAM.Config}}{{.Gateway}}{{end}}'") || "172.17.0.1";
+}
+/** DDEV tool ports, used when the global config does not say otherwise */
+var DEFAULT_TOOL_PORTS = {
+	"mailpit-http-port": "8025",
+	"mailpit-https-port": "8026",
+	"xhgui-http-port": "8143",
+	"xhgui-https-port": "8142"
+};
+/**
+* Read the ports DDEV publishes its tools on.
+*
+* ddev-router publishes these on 0.0.0.0, and Docker bypasses UFW for
+* published ports, so a firewall rule cannot protect them — the forward auth
+* middleware is the only thing that can. Read them rather than hardcode: they
+* are configurable, and an entry point Traefik does not know about is ignored.
+*/
+function readToolPorts(io = nodeIo) {
+	const output = io.execSilent("su - ddev -c 'ddev config global'");
+	const ports = [];
+	for (const [key, fallback] of Object.entries(DEFAULT_TOOL_PORTS)) {
+		const match = new RegExp(`^${key}=(\\d+)$`, "m").exec(output);
+		ports.push(match?.[1] ?? fallback);
+	}
+	return [...new Set(ports)];
+}
+/**
+* Build the static config attaching forward auth to every entry point.
+*
+* The error page middleware stays on the web entry points only: a 502 from a
+* stopped project should show the waiting page, while a tool port has nothing
+* to wait for.
+*/
+function buildStaticConfig(toolPorts) {
+	const webEntryPoint = (name) => `  ${name}:
+    http:
+      middlewares:
+        - trafic-auth@file
+        - trafic-errors@file
+`;
+	const toolEntryPoint = (port) => `  http-${port}:
+    http:
+      middlewares:
+        - trafic-auth@file
+`;
+	return `entryPoints:
+${webEntryPoint("http-80")}${webEntryPoint("http-443")}${toolPorts.map(toolEntryPoint).join("")}`;
+}
+/**
+* Configure Traefik for forward auth
+*/
+function configureTraefik(io = nodeIo) {
+	step("Configure Traefik for forward auth");
+	io.exec("mkdir -p /home/ddev/.ddev/traefik/custom-global-config", { silent: true });
+	io.exec("chown -R ddev:ddev /home/ddev/.ddev", { silent: true });
+	const gatewayIp = getDockerGatewayIp(io);
+	const dynamicConfig = `# Trafic: Forward auth middleware definition
+http:
+  middlewares:
+    trafic-auth:
+      forwardAuth:
+        address: "http://${gatewayIp}:9876/__auth__"
+        authResponseHeaders:
+          - "X-Trafic-Project"
+
+    trafic-errors:
+      errors:
+        status:
+          - "502"
+          - "503"
+        service: trafic-service
+        query: "/"
+
+  routers:
+    # Lowest priority, so a DDEV project router always wins. It only matches
+    # when none does - which is what a stopped project produces, because DDEV
+    # removes that project's router and Traefik would otherwise answer 404.
+    # Without this the waiting page never appears and scale-to-zero never
+    # restarts anything. Auth is unaffected: it is attached at the entry
+    # point, not here, so this cannot reintroduce the bypass that #27 fixed.
+    #
+    # Two of them, because a router carrying tls only matches HTTPS entry
+    # points: one alone would leave plain HTTP answering 404.
+    trafic-catchall:
+      rule: "PathPrefix(\`/\`)"
+      priority: 1
+      service: trafic-service
+
+    trafic-catchall-tls:
+      rule: "PathPrefix(\`/\`)"
+      priority: 1
+      service: trafic-service
+      tls: {}
+
+  services:
+    trafic-service:
+      loadBalancer:
+        servers:
+          - url: "http://${gatewayIp}:9876"
+`;
+	io.writeFile("/home/ddev/.ddev/traefik/trafic.yaml", dynamicConfig);
+	io.exec("chown ddev:ddev /home/ddev/.ddev/traefik/trafic.yaml", { silent: true });
+	io.writeFile("/home/ddev/.ddev/traefik/custom-global-config/trafic.yaml", dynamicConfig);
+	io.exec("chown ddev:ddev /home/ddev/.ddev/traefik/custom-global-config/trafic.yaml", { silent: true });
+	const staticConfig = buildStaticConfig(readToolPorts(io));
+	io.writeFile("/home/ddev/.ddev/traefik/static_config.trafic.yaml", staticConfig);
+	io.exec("chown ddev:ddev /home/ddev/.ddev/traefik/static_config.trafic.yaml", { silent: true });
+	success("Traefik configured with Trafic middleware");
+}
+//#endregion
+//#region src/utils/traefik.ts
+/**
+* Files DDEV reads the dynamic Traefik configuration from, relative to the
+* .ddev directory. Both are written by setup: DDEV 1.25+ picks up
+* custom-global-config, older versions watch the traefik root.
+*/
+var DYNAMIC_CONFIGS = ["traefik/trafic.yaml", "traefik/custom-global-config/trafic.yaml"];
+/** Matches the host in an agent URL, e.g. http://172.17.0.1:9876/__auth__ */
+var AGENT_URL = /http:\/\/(\d+\.\d+\.\d+\.\d+):(\d+)/g;
+/**
+* The address the forward-auth middleware currently points at.
+*/
+function readForwardAuthAddress(content) {
+	return /http:\/\/(\d+\.\d+\.\d+\.\d+):\d+/.exec(content)?.[1];
+}
+/**
+* Point every agent URL in a dynamic config at a different host, keeping
+* each port as it was.
+*/
+function rewriteForwardAuthAddress(content, gatewayIp) {
+	return content.replace(AGENT_URL, `http://${gatewayIp}:$2`);
+}
+/**
+* Correct the forward-auth address if the Docker gateway has moved.
+*
+* setup runs `configureTraefik` before any DDEV project exists, so the
+* `ddev_default` network is absent and the address falls back to the default
+* bridge. Once a project starts, that address is stale. Migration 0006 exists
+* to fix it on servers provisioned earlier, but `markAllMigrationsApplied()`
+* marks it applied on fresh ones, so nothing ever recomputed it.
+*
+* Traefik watches the dynamic config, so rewriting the file is enough — no
+* restart. Any failure is logged and ignored: a stale address is survivable,
+* an agent that will not start is not.
+*/
+function syncForwardAuthAddress(projectListPath, io = nodeIo) {
+	try {
+		const ddevDir = dirname(projectListPath);
+		const gatewayIp = getDockerGatewayIp(io);
+		const changed = [];
+		for (const relative of DYNAMIC_CONFIGS) {
+			const path = join(ddevDir, relative);
+			if (!io.fileExists(path)) continue;
+			const content = io.readFile(path);
+			const current = readForwardAuthAddress(content);
+			if (!current || current === gatewayIp) continue;
+			io.writeFile(path, rewriteForwardAuthAddress(content, gatewayIp));
+			changed.push(path);
+		}
+		if (changed.length > 0) console.log(`Traefik forward auth: corrected address to ${gatewayIp} in ${changed.length} file(s)`);
+	} catch (error) {
+		console.warn(`Could not check the Traefik forward auth address: ${error instanceof Error ? error.message : error}`);
+	}
+}
+//#endregion
 //#region src/server.ts
 var __dirname = dirname(fileURLToPath(import.meta.url));
 var config;
@@ -636,6 +1013,31 @@ async function handleErrors(req, res) {
 	}, 100);
 }
 /**
+* Decide whether Caddy may obtain a certificate for a hostname.
+*
+* Caddy's on-demand TLS asks before issuing for a name it has not seen.
+* Without a check, anyone pointing a DNS record at this server would make it
+* request a certificate, and Let's Encrypt quota is per registered domain —
+* a handful of strangers could exhaust it for every preview.
+*/
+function allowTlsFor(domain, index) {
+	return index.has(domain.toLowerCase());
+}
+/**
+* Handle Caddy's on-demand TLS ask. 2xx allows issuance, anything else denies.
+*/
+function handleTlsAsk(req, res) {
+	const domain = new URL(req.url ?? "/", `http://${req.headers.host}`).searchParams.get("domain") ?? "";
+	if (allowTlsFor(domain, hostnameIndex)) {
+		res.writeHead(200);
+		res.end("ok");
+		return;
+	}
+	console.log(`TLS ask denied for unknown hostname: ${domain || "(none)"}`);
+	res.writeHead(404, { "Content-Type": "text/plain" });
+	res.end("Unknown project");
+}
+/**
 * Handle status polling requests
 */
 function handleStatus(req, res) {
@@ -662,6 +1064,7 @@ async function handleRequest(req, res) {
 	try {
 		if (url === "/__auth__" || url.startsWith("/__auth__/")) handleAuth(req, res);
 		else if (url === "/__status__" || url.startsWith("/__status__/")) handleStatus(req, res);
+		else if (url === "/__tls__" || url.startsWith("/__tls__?")) handleTlsAsk(req, res);
 		else if (url === "/__health__") {
 			res.writeHead(200, { "Content-Type": "application/json" });
 			res.end(JSON.stringify({
@@ -697,6 +1100,7 @@ function reloadProjects() {
 function startServer(agentConfig) {
 	config = agentConfig;
 	initDb(config.dbPath);
+	syncForwardAuthAddress(config.projectListPath);
 	reloadProjects();
 	watchProjectList(config.projectListPath, () => {
 		console.log("Project list changed, reloading...");
@@ -717,6 +1121,6 @@ function startServer(agentConfig) {
 	});
 }
 //#endregion
-export { checkAuth as C, parseBearerToken as D, parseBasicAuth as E, watchProjectList as S, matchIp as T, getProjectInfo as _, cleanOldLogs as a, startProject as b, getDb as c, initDb as d, logAccess as f, getProjectFromHostname as g, buildHostnameIndex as h, shouldNeverStop as i, getIdleProjects as l, updateProjectAccess as m, getIdleTimeoutMs as n, closeDb as o, setProjectStatus as p, loadProjectConfig as r, getAccessLogs as s, startServer as t, getProject as u, listProjects as v, matchHostname as w, stopProject as x, loadProjectList as y };
+export { logAccess as A, watchProjectList as B, cleanOldLogs as C, getIdleProjects as D, getDb as E, getProjectInfo as F, parseBearerToken as G, matchHostname as H, listProjects as I, loadProjectList as L, updateProjectAccess as M, buildHostnameIndex as N, getProject as O, getProjectFromHostname as P, startProject as R, shouldNeverStop as S, getAccessLogs as T, matchIp as U, checkAuth as V, parseBasicAuth as W, step as _, configureTraefik as a, getIdleTimeoutMs as b, installSystemDeps as c, exec as d, execSilent as f, setDryRun as g, resetSteps as h, configureDdev as i, setProjectStatus as j, initDb as k, nodeIo as l, isRoot as m, startServer as n, getDockerGatewayIp as o, info as p, addDdevAptRepo as r, installDdev as s, allowTlsFor as t, error as u, success as v, closeDb as w, loadProjectConfig as x, warn as y, stopProject as z };
 
-//# sourceMappingURL=server-zVWzPuj2.js.map
+//# sourceMappingURL=server-BgOOBUhR.js.map