@studiometa/trafic-agent 0.1.36 → 0.1.38

package/README.md

@@ -157,12 +157,114 @@ The agent:
 
 ## Endpoints
 
+All internal endpoints are prefixed with `__` so they cannot collide with a
+project's own paths. Everything else is treated as a request for a project.
+
 | Endpoint | Description |
 |----------|-------------|
-| `GET /auth` | Forward auth for Traefik |
-| `GET /errors` | Error handler for stopped projects |
-| `GET /status` | Health check |
-| `GET /projects` | List all projects (JSON) |
+| `GET /__auth__` | Forward auth for Traefik. `200` allows, `401` prompts for basic auth |
+| `GET /__status__?project=<name>` | Project status as JSON, for the waiting page to poll |
+| `GET /__health__` | Agent health and version |
+| anything else | Waiting page for a known project, error page otherwise |
+
+## TLS
+
+Traefik obtains the certificates, and `setup --email` is what turns that on:
+
+```bash
+trafic setup --host server.example.com --tld previews.example.com \
+  --email admin@example.com
+```
+
+With an email, DDEV sets `use_letsencrypt=true` and Traefik requests a
+certificate per project hostname on first use — previews included, since each
+one gets its own router. Without an email, projects are served with a locally
+trusted mkcert certificate, which is fine behind a proxy that terminates TLS
+itself but shows a browser warning if used directly.
+
+Two limits worth knowing before you rely on it:
+
+- Let's Encrypt allows **50 new certificates per registered domain per week**.
+  Each preview hostname is a new certificate, so environments that churn fast
+  can hit the ceiling. Renewals do not count against it.
+- Turning Let's Encrypt off does not discard certificates already issued.
+  Traefik keeps them in `acme.json` in the `ddev-global-cache` volume and
+  serves them again after a restart, so `configureDdev` deletes that storage
+  when Let's Encrypt is disabled.
+
+Wildcard certificates would avoid the per-hostname limit but need a DNS-01
+challenge, which DDEV does not do. If you churn tens of previews a week, put a
+proxy in front that can (Caddy or Traefik with a DNS provider) and disable
+Let's Encrypt in DDEV so the two do not both try.
+
+## Network exposure
+
+**`ufw default deny incoming` does not cover the ports Docker publishes.**
+Docker adds its rules to `nat/PREROUTING` and the `DOCKER` chain of `FORWARD`,
+both of which are evaluated before UFW's chains. So the ports ddev-router
+publishes are reachable from the internet whatever UFW says about them, and
+`ufw status` will not tell you otherwise.
+
+`setup` opens 22, 80 and 443, and 9876 for the agent from the Docker bridge
+only. Those rules are accurate. What they do **not** do is close the ports
+ddev-router publishes for DDEV's tools:
+
+| Port | Service |
+|------|---------|
+| 8025, 8026 | Mailpit |
+| 8142, 8143 | xhgui |
+
+Both layers now apply:
+
+1. **`DOCKER-USER` rules**, installed by `setup`. That is the chain Docker
+   jumps to first in `FORWARD` and never flushes, so it is the only host-level
+   hook that can filter a published port. The rules drop traffic to the tool
+   ports unless it comes from Docker's own networks. They match on the
+   *original* destination port (`-m conntrack --ctorigdstport`), because by
+   `FORWARD` the destination has already been rewritten to the container.
+
+   They live in `/usr/local/sbin/trafic-docker-firewall`, reapplied at boot and
+   after any Docker restart by `trafic-docker-firewall.service` — Docker
+   recreates `DOCKER-USER` empty and nothing else would restore them.
+   **They will not appear in `ufw status`.** Inspect them with
+   `iptables -S DOCKER-USER`.
+
+2. **Forward auth**, attached to every entry point ddev-router publishes, so a
+   request that does reach a tool port still needs credentials. An earlier
+   version attached it only to 80 and 443, which left xhgui answering from the
+   internet with no authentication at all.
+
+Access from the host itself is unaffected: a connection to `127.0.0.1:8026`
+goes through Docker's userland proxy rather than `FORWARD`, so an SSH tunnel
+still works:
+
+```bash
+ssh -L 8026:127.0.0.1:8026 ddev@server.example.com
+# then open https://localhost:8026
+```
+
+### A provider firewall is not a substitute
+
+Recommended as an extra layer, but do not rely on it alone. Measured on an OVH
+dedicated server with the Edge Firewall enabled and a correct rule denying
+these ports: a connection from **another host inside OVH** still completed in
+113ms, while a port with nothing listening was dropped and timed out at 12s.
+The deny applies to traffic crossing the provider's edge; traffic that never
+crosses it is not filtered.
+
+Anyone able to rent a VM from the same provider is inside that blind spot,
+which for a large host is a very low bar. That is why the `DOCKER-USER` rules
+above exist: they apply to every packet regardless of origin.
+
+On OVH the setting is the Network Firewall in the control panel. Two things to
+know: it is *stateless*, so `permit tcp established` is required or return
+traffic for outbound connections is dropped, and it is IPv4-only. `setup` does
+not configure it — it can neither create nor verify it.
+
+Binding ddev-router to loopback only (`router-bind-all-interfaces=false`)
+closes everything at once, but then nothing serves the public and you need a
+host proxy in front. That is a reasonable setup; it is just a different one
+from what `setup` builds.
 
 ## License
 

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { d as validateConfig, i as runPendingMigrations, l as loadConfig, n as setup, r as listMigrations, s as startIdleScheduler, t as audit } from "./setup-ClYjldGS.js";
-import { E as closeDb, b as success, g as isRoot, h as info, p as exec, r as startServer, x as warn, y as step } from "./server-4J8XoTP3.js";
+import { g as validateConfig, i as runPendingMigrations, m as loadConfig, n as setup, r as listMigrations, s as startIdleScheduler, t as audit } from "./setup-BFU-DlX3.js";
+import { E as exec, M as step, N as success, O as info, P as warn, h as closeDb, k as isRoot, n as startServer } from "./server-CvSztHW2.js";
 import { readFileSync } from "node:fs";
 import { execSync, spawnSync } from "node:child_process";
 import { parseArgs } from "node:util";
@@ -108,7 +108,7 @@ function runUpgrade(dryRun = false, reExecArgs) {
 	}
 	const alreadyReExeced = process.env["TRAFIC_UPGRADE_REEXEC"] === "1";
 	step("Check for updates");
-	const current = "0.1.36";
+	const current = "0.1.38";
 	info(`Current version: ${current}`);
 	const latest = fetchLatestVersion();
 	if (!latest) warn("Could not reach npm registry — skipping version check");
@@ -191,7 +191,7 @@ function printHelp() {
 	console.log(HELP.trim());
 }
 function printVersion() {
-	console.log("0.1.36");
+	console.log("0.1.38");
 }
 async function runStart(values) {
 	const config = loadConfig(values.config);

package/dist/index.d.ts

@@ -2,6 +2,7 @@ export type { AgentConfig, AuthConfig, AuthRule, AuthRequest, AuthResult, DdevPr
 export { loadConfig, validateConfig, parseDuration } from "./utils/config.js";
 export { checkAuth, matchIp, matchHostname, parseBasicAuth, parseBearerToken, } from "./utils/auth.js";
 export { loadProjectList, buildHostnameIndex, getProjectFromHostname, watchProjectList, getProjectInfo, startProject, stopProject, listProjects, } from "./utils/ddev.js";
+export { buildDockerFirewallScript, buildDockerFirewallUnit, configureDockerFirewall, DOCKER_FIREWALL_SCRIPT, DOCKER_FIREWALL_UNIT, } from "./setup/docker-firewall.js";
 export { initDb, getDb, closeDb, updateProjectAccess, getProject, setProjectStatus, getIdleProjects, logAccess, getAccessLogs, cleanOldLogs, } from "./utils/db.js";
 export { loadProjectConfig, shouldNeverStop, getIdleTimeoutMs, } from "./utils/project-config.js";
 export type { ProjectConfig } from "./utils/project-config.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,WAAW,EACX,UAAU,EACV,QAAQ,EACR,WAAW,EACX,UAAU,EACV,WAAW,EACX,aAAa,EACb,SAAS,GACV,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAG9E,OAAO,EACL,SAAS,EACT,OAAO,EACP,aAAa,EACb,cAAc,EACd,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,WAAW,EACX,YAAY,GACb,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,MAAM,EACN,KAAK,EACL,OAAO,EACP,mBAAmB,EACnB,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,SAAS,EACT,aAAa,EACb,YAAY,GACb,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAG/D,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG5E,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,WAAW,EACX,UAAU,EACV,QAAQ,EACR,WAAW,EACX,UAAU,EACV,WAAW,EACX,aAAa,EACb,SAAS,GACV,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAG9E,OAAO,EACL,SAAS,EACT,OAAO,EACP,aAAa,EACb,cAAc,EACd,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,WAAW,EACX,YAAY,GACb,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,MAAM,EACN,KAAK,EACL,OAAO,EACP,mBAAmB,EACnB,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,SAAS,EACT,aAAa,EACb,YAAY,GACb,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAG/D,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG5E,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -1,3 +1,3 @@
-import { a as printAuditResults, c as stopIdleProjects, d as validateConfig, l as loadConfig, n as setup, o as runAudit, s as startIdleScheduler, t as audit, u as parseDuration } from "./setup-ClYjldGS.js";
-import { A as getProject, B as startProject, C as loadProjectConfig, D as getAccessLogs, E as closeDb, F as buildHostnameIndex, G as matchIp, H as watchProjectList, I as getProjectFromHostname, K as parseBasicAuth, L as getProjectInfo, M as logAccess, N as setProjectStatus, O as getDb, P as updateProjectAccess, R as listProjects, S as getIdleTimeoutMs, T as cleanOldLogs, U as checkAuth, V as stopProject, W as matchHostname, j as initDb, k as getIdleProjects, q as parseBearerToken, r as startServer, w as shouldNeverStop, z as loadProjectList } from "./server-4J8XoTP3.js";
-export { audit, buildHostnameIndex, checkAuth, cleanOldLogs, closeDb, getAccessLogs, getDb, getIdleProjects, getIdleTimeoutMs, getProject, getProjectFromHostname, getProjectInfo, initDb, listProjects, loadConfig, loadProjectConfig, loadProjectList, logAccess, matchHostname, matchIp, parseBasicAuth, parseBearerToken, parseDuration, printAuditResults, runAudit, setProjectStatus, setup, shouldNeverStop, startIdleScheduler, startProject, startServer, stopIdleProjects, stopProject, updateProjectAccess, validateConfig, watchProjectList };
+import { a as printAuditResults, c as stopIdleProjects, d as buildDockerFirewallScript, f as buildDockerFirewallUnit, g as validateConfig, h as parseDuration, l as DOCKER_FIREWALL_SCRIPT, m as loadConfig, n as setup, o as runAudit, p as configureDockerFirewall, s as startIdleScheduler, t as audit, u as DOCKER_FIREWALL_UNIT } from "./setup-BFU-DlX3.js";
+import { B as startProject, C as updateProjectAccess, F as buildHostnameIndex, G as matchIp, H as watchProjectList, I as getProjectFromHostname, K as parseBasicAuth, L as getProjectInfo, R as listProjects, S as setProjectStatus, U as checkAuth, V as stopProject, W as matchHostname, _ as getDb, b as initDb, d as getIdleTimeoutMs, f as loadProjectConfig, g as getAccessLogs, h as closeDb, m as cleanOldLogs, n as startServer, p as shouldNeverStop, q as parseBearerToken, v as getIdleProjects, x as logAccess, y as getProject, z as loadProjectList } from "./server-CvSztHW2.js";
+export { DOCKER_FIREWALL_SCRIPT, DOCKER_FIREWALL_UNIT, audit, buildDockerFirewallScript, buildDockerFirewallUnit, buildHostnameIndex, checkAuth, cleanOldLogs, closeDb, configureDockerFirewall, getAccessLogs, getDb, getIdleProjects, getIdleTimeoutMs, getProject, getProjectFromHostname, getProjectInfo, initDb, listProjects, loadConfig, loadProjectConfig, loadProjectList, logAccess, matchHostname, matchIp, parseBasicAuth, parseBearerToken, parseDuration, printAuditResults, runAudit, setProjectStatus, setup, shouldNeverStop, startIdleScheduler, startProject, startServer, stopIdleProjects, stopProject, updateProjectAccess, validateConfig, watchProjectList };

package/dist/{server-4J8XoTP3.js → server-CvSztHW2.js}

@@ -394,6 +394,131 @@ function listProjects() {
 	}
 }
 //#endregion
+//#region src/setup/steps.ts
+var stepNumber = 0;
+var dryRun = false;
+/**
+* Set dry-run mode
+*/
+function setDryRun(value) {
+	dryRun = value;
+}
+/**
+* Reset step counter
+*/
+function resetSteps() {
+	stepNumber = 0;
+}
+/**
+* Log a step
+*/
+function step(message) {
+	stepNumber++;
+	console.log(`\n\x1b[36m[${stepNumber}]\x1b[0m ${message}`);
+}
+/**
+* Log success
+*/
+function success(message) {
+	console.log(`    \x1b[32m✓\x1b[0m ${message}`);
+}
+/**
+* Log warning
+*/
+function warn(message) {
+	console.log(`    \x1b[33m⚠\x1b[0m ${message}`);
+}
+/**
+* Log error
+*/
+function error(message) {
+	console.log(`    \x1b[31m✗\x1b[0m ${message}`);
+}
+/**
+* Log info
+*/
+function info(message) {
+	console.log(`    ${message}`);
+}
+/**
+* Execute a command (or show in dry-run mode)
+*/
+function exec(command, options) {
+	if (dryRun) {
+		if (!options?.silent) console.log(`    \x1b[90m$ ${command}\x1b[0m`);
+		return "";
+	}
+	try {
+		return execSync(command, {
+			encoding: "utf-8",
+			stdio: options?.silent ? "pipe" : "inherit"
+		});
+	} catch (err) {
+		throw new Error(`Command failed: ${command}\n${err.stderr ?? ""}`);
+	}
+}
+/**
+* Execute a command and return output (silent)
+*/
+function execSilent(command) {
+	if (dryRun) return "";
+	try {
+		return execSync(command, {
+			encoding: "utf-8",
+			stdio: "pipe"
+		}).trim();
+	} catch {
+		return "";
+	}
+}
+/**
+* Check if a command exists
+*/
+function commandExists(command) {
+	try {
+		execSync(`which ${command}`, { stdio: "pipe" });
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Check if running as root
+*/
+function isRoot() {
+	return process.getuid?.() === 0;
+}
+/**
+* Write a file (or show in dry-run mode)
+*/
+function writeFile(path, content) {
+	if (dryRun) {
+		console.log(`    \x1b[90mWrite ${path}:\x1b[0m`);
+		const lines = content.split("\n").slice(0, 5);
+		for (const line of lines) console.log(`    \x1b[90m  ${line}\x1b[0m`);
+		if (content.split("\n").length > 5) console.log(`    \x1b[90m  ...\x1b[0m`);
+		return;
+	}
+	writeFileSync(path, content);
+}
+//#endregion
+//#region src/setup/io.ts
+/**
+* The real implementation, used when no io is injected.
+*
+* `writeFile` comes from steps.js rather than `node:fs` so writes are
+* skipped in dry-run mode. Reads stay direct: they change nothing.
+*/
+var nodeIo = {
+	exec,
+	execSilent,
+	commandExists,
+	writeFile,
+	fileExists: existsSync,
+	readFile: (path) => readFileSync(path, "utf-8"),
+	env: process.env
+};
+//#endregion
 //#region src/utils/db.ts
 var db = null;
 /**
@@ -574,131 +699,6 @@ function getIdleTimeoutMs(config) {
 	return ms > 0 ? ms : void 0;
 }
 //#endregion
-//#region src/setup/steps.ts
-var stepNumber = 0;
-var dryRun = false;
-/**
-* Set dry-run mode
-*/
-function setDryRun(value) {
-	dryRun = value;
-}
-/**
-* Reset step counter
-*/
-function resetSteps() {
-	stepNumber = 0;
-}
-/**
-* Log a step
-*/
-function step(message) {
-	stepNumber++;
-	console.log(`\n\x1b[36m[${stepNumber}]\x1b[0m ${message}`);
-}
-/**
-* Log success
-*/
-function success(message) {
-	console.log(`    \x1b[32m✓\x1b[0m ${message}`);
-}
-/**
-* Log warning
-*/
-function warn(message) {
-	console.log(`    \x1b[33m⚠\x1b[0m ${message}`);
-}
-/**
-* Log error
-*/
-function error(message) {
-	console.log(`    \x1b[31m✗\x1b[0m ${message}`);
-}
-/**
-* Log info
-*/
-function info(message) {
-	console.log(`    ${message}`);
-}
-/**
-* Execute a command (or show in dry-run mode)
-*/
-function exec(command, options) {
-	if (dryRun) {
-		if (!options?.silent) console.log(`    \x1b[90m$ ${command}\x1b[0m`);
-		return "";
-	}
-	try {
-		return execSync(command, {
-			encoding: "utf-8",
-			stdio: options?.silent ? "pipe" : "inherit"
-		});
-	} catch (err) {
-		throw new Error(`Command failed: ${command}\n${err.stderr ?? ""}`);
-	}
-}
-/**
-* Execute a command and return output (silent)
-*/
-function execSilent(command) {
-	if (dryRun) return "";
-	try {
-		return execSync(command, {
-			encoding: "utf-8",
-			stdio: "pipe"
-		}).trim();
-	} catch {
-		return "";
-	}
-}
-/**
-* Check if a command exists
-*/
-function commandExists(command) {
-	try {
-		execSync(`which ${command}`, { stdio: "pipe" });
-		return true;
-	} catch {
-		return false;
-	}
-}
-/**
-* Check if running as root
-*/
-function isRoot() {
-	return process.getuid?.() === 0;
-}
-/**
-* Write a file (or show in dry-run mode)
-*/
-function writeFile(path, content) {
-	if (dryRun) {
-		console.log(`    \x1b[90mWrite ${path}:\x1b[0m`);
-		const lines = content.split("\n").slice(0, 5);
-		for (const line of lines) console.log(`    \x1b[90m  ${line}\x1b[0m`);
-		if (content.split("\n").length > 5) console.log(`    \x1b[90m  ...\x1b[0m`);
-		return;
-	}
-	writeFileSync(path, content);
-}
-//#endregion
-//#region src/setup/io.ts
-/**
-* The real implementation, used when no io is injected.
-*
-* `writeFile` comes from steps.js rather than `node:fs` so writes are
-* skipped in dry-run mode. Reads stay direct: they change nothing.
-*/
-var nodeIo = {
-	exec,
-	execSilent,
-	commandExists,
-	writeFile,
-	fileExists: existsSync,
-	readFile: (path) => readFileSync(path, "utf-8"),
-	env: process.env
-};
-//#endregion
 //#region src/setup/ddev.ts
 /**
 * Install system dependencies required by Trafic
@@ -1110,31 +1110,6 @@ async function handleErrors(req, res) {
 	});
 }
 /**
-* Decide whether Caddy may obtain a certificate for a hostname.
-*
-* Caddy's on-demand TLS asks before issuing for a name it has not seen.
-* Without a check, anyone pointing a DNS record at this server would make it
-* request a certificate, and Let's Encrypt quota is per registered domain —
-* a handful of strangers could exhaust it for every preview.
-*/
-function allowTlsFor(domain, index) {
-	return index.has(domain.toLowerCase());
-}
-/**
-* Handle Caddy's on-demand TLS ask. 2xx allows issuance, anything else denies.
-*/
-function handleTlsAsk(req, res) {
-	const domain = new URL(req.url ?? "/", `http://${req.headers.host}`).searchParams.get("domain") ?? "";
-	if (allowTlsFor(domain, hostnameIndex)) {
-		res.writeHead(200);
-		res.end("ok");
-		return;
-	}
-	console.log(`TLS ask denied for unknown hostname: ${domain || "(none)"}`);
-	res.writeHead(404, { "Content-Type": "text/plain" });
-	res.end("Unknown project");
-}
-/**
 * Handle status polling requests
 */
 async function handleStatus(req, res) {
@@ -1178,7 +1153,6 @@ async function handleRequest(req, res) {
 	try {
 		if (path === "/__auth__" || path.startsWith("/__auth__/")) handleAuth(req, res);
 		else if (path === "/__status__" || path.startsWith("/__status__/")) await handleStatus(req, res);
-		else if (path === "/__tls__") handleTlsAsk(req, res);
 		else if (path === "/__health__") {
 			res.writeHead(200, { "Content-Type": "application/json" });
 			res.end(JSON.stringify({
@@ -1235,6 +1209,6 @@ function startServer(agentConfig) {
 	});
 }
 //#endregion
-export { getProject as A, startProject as B, loadProjectConfig as C, getAccessLogs as D, closeDb as E, buildHostnameIndex as F, matchIp as G, watchProjectList as H, getProjectFromHostname as I, parseBasicAuth as K, getProjectInfo as L, logAccess as M, setProjectStatus as N, getDb as O, updateProjectAccess as P, listProjects as R, getIdleTimeoutMs as S, cleanOldLogs as T, checkAuth as U, stopProject as V, matchHostname as W, resetSteps as _, configureDdev as a, success as b, installDdev as c, nodeIo as d, error as f, isRoot as g, info as h, addDdevAptRepo as i, initDb as j, getIdleProjects as k, installSystemDeps as l, execSilent as m, routePath as n, configureTraefik as o, exec as p, parseBearerToken as q, startServer as r, getDockerGatewayIp as s, allowTlsFor as t, purgeTraefikAcmeStorage as u, setDryRun as v, shouldNeverStop as w, warn as x, step as y, loadProjectList as z };
+export { resetSteps as A, startProject as B, updateProjectAccess as C, execSilent as D, exec as E, buildHostnameIndex as F, matchIp as G, watchProjectList as H, getProjectFromHostname as I, parseBasicAuth as K, getProjectInfo as L, step as M, success as N, info as O, warn as P, listProjects as R, setProjectStatus as S, error as T, checkAuth as U, stopProject as V, matchHostname as W, getDb as _, configureTraefik as a, initDb as b, installSystemDeps as c, getIdleTimeoutMs as d, loadProjectConfig as f, getAccessLogs as g, closeDb as h, configureDdev as i, setDryRun as j, isRoot as k, purgeTraefikAcmeStorage as l, cleanOldLogs as m, startServer as n, getDockerGatewayIp as o, shouldNeverStop as p, parseBearerToken as q, addDdevAptRepo as r, installDdev as s, routePath as t, readToolPorts as u, getIdleProjects as v, nodeIo as w, logAccess as x, getProject as y, loadProjectList as z };
 
-//# sourceMappingURL=server-4J8XoTP3.js.map
+//# sourceMappingURL=server-CvSztHW2.js.map