@studiometa/trafic-agent 0.1.37 → 0.1.38

package/README.md

@@ -214,29 +214,52 @@ ddev-router publishes for DDEV's tools:
 | 8025, 8026 | Mailpit |
 | 8142, 8143 | xhgui |
 
-Those are protected by **forward auth, not by the firewall** — the middleware
-is attached to every entry point ddev-router publishes, so an unauthenticated
-request gets `401` on a tool port exactly as it does on 443. An earlier
-version attached it only to 80 and 443, which left xhgui answering from the
-internet with no authentication at all; that is fixed, and it is the reason
-the middleware is attached per entry point rather than per project router.
-
-If you want those ports closed at the network level rather than answered with
-a `401`, two options actually work:
-
-1. **A firewall in front of the server.** The packets never reach the host, so
-   Docker's rules are irrelevant. On OVH dedicated servers this is the Network
-   Firewall in the control panel — note it is *stateless*, so return traffic
-   needs allowing explicitly. This is the recommended defence in depth. It is
-   deliberately not automated: `setup` cannot create or verify it, and a tool
-   that pretends to configure something it cannot check is worse than one that
-   tells you to do it yourself.
-2. **Rules in the `DOCKER-USER` chain**, which Docker evaluates first in
-   `FORWARD` and never overwrites. Match on the pre-DNAT port
-   (`-m conntrack --ctorigdstport 8025`), because by `FORWARD` the destination
-   has already been rewritten to the container. Remember these live outside
-   UFW: they need their own persistence across reboots, an `ip6tables`
-   equivalent, and they will not show up in `ufw status`.
+Both layers now apply:
+
+1. **`DOCKER-USER` rules**, installed by `setup`. That is the chain Docker
+   jumps to first in `FORWARD` and never flushes, so it is the only host-level
+   hook that can filter a published port. The rules drop traffic to the tool
+   ports unless it comes from Docker's own networks. They match on the
+   *original* destination port (`-m conntrack --ctorigdstport`), because by
+   `FORWARD` the destination has already been rewritten to the container.
+
+   They live in `/usr/local/sbin/trafic-docker-firewall`, reapplied at boot and
+   after any Docker restart by `trafic-docker-firewall.service` — Docker
+   recreates `DOCKER-USER` empty and nothing else would restore them.
+   **They will not appear in `ufw status`.** Inspect them with
+   `iptables -S DOCKER-USER`.
+
+2. **Forward auth**, attached to every entry point ddev-router publishes, so a
+   request that does reach a tool port still needs credentials. An earlier
+   version attached it only to 80 and 443, which left xhgui answering from the
+   internet with no authentication at all.
+
+Access from the host itself is unaffected: a connection to `127.0.0.1:8026`
+goes through Docker's userland proxy rather than `FORWARD`, so an SSH tunnel
+still works:
+
+```bash
+ssh -L 8026:127.0.0.1:8026 ddev@server.example.com
+# then open https://localhost:8026
+```
+
+### A provider firewall is not a substitute
+
+Recommended as an extra layer, but do not rely on it alone. Measured on an OVH
+dedicated server with the Edge Firewall enabled and a correct rule denying
+these ports: a connection from **another host inside OVH** still completed in
+113ms, while a port with nothing listening was dropped and timed out at 12s.
+The deny applies to traffic crossing the provider's edge; traffic that never
+crosses it is not filtered.
+
+Anyone able to rent a VM from the same provider is inside that blind spot,
+which for a large host is a very low bar. That is why the `DOCKER-USER` rules
+above exist: they apply to every packet regardless of origin.
+
+On OVH the setting is the Network Firewall in the control panel. Two things to
+know: it is *stateless*, so `permit tcp established` is required or return
+traffic for outbound connections is dropped, and it is IPv4-only. `setup` does
+not configure it — it can neither create nor verify it.
 
 Binding ddev-router to loopback only (`router-bind-all-interfaces=false`)
 closes everything at once, but then nothing serves the public and you need a

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { d as validateConfig, i as runPendingMigrations, l as loadConfig, n as setup, r as listMigrations, s as startIdleScheduler, t as audit } from "./setup-DHhQF7wW.js";
-import { T as closeDb, b as warn, f as exec, h as isRoot, m as info, n as startServer, v as step, y as success } from "./server-CLrB1zpR.js";
+import { g as validateConfig, i as runPendingMigrations, m as loadConfig, n as setup, r as listMigrations, s as startIdleScheduler, t as audit } from "./setup-BFU-DlX3.js";
+import { E as exec, M as step, N as success, O as info, P as warn, h as closeDb, k as isRoot, n as startServer } from "./server-CvSztHW2.js";
 import { readFileSync } from "node:fs";
 import { execSync, spawnSync } from "node:child_process";
 import { parseArgs } from "node:util";
@@ -108,7 +108,7 @@ function runUpgrade(dryRun = false, reExecArgs) {
 	}
 	const alreadyReExeced = process.env["TRAFIC_UPGRADE_REEXEC"] === "1";
 	step("Check for updates");
-	const current = "0.1.37";
+	const current = "0.1.38";
 	info(`Current version: ${current}`);
 	const latest = fetchLatestVersion();
 	if (!latest) warn("Could not reach npm registry — skipping version check");
@@ -191,7 +191,7 @@ function printHelp() {
 	console.log(HELP.trim());
 }
 function printVersion() {
-	console.log("0.1.37");
+	console.log("0.1.38");
 }
 async function runStart(values) {
 	const config = loadConfig(values.config);

package/dist/index.d.ts

@@ -2,6 +2,7 @@ export type { AgentConfig, AuthConfig, AuthRule, AuthRequest, AuthResult, DdevPr
 export { loadConfig, validateConfig, parseDuration } from "./utils/config.js";
 export { checkAuth, matchIp, matchHostname, parseBasicAuth, parseBearerToken, } from "./utils/auth.js";
 export { loadProjectList, buildHostnameIndex, getProjectFromHostname, watchProjectList, getProjectInfo, startProject, stopProject, listProjects, } from "./utils/ddev.js";
+export { buildDockerFirewallScript, buildDockerFirewallUnit, configureDockerFirewall, DOCKER_FIREWALL_SCRIPT, DOCKER_FIREWALL_UNIT, } from "./setup/docker-firewall.js";
 export { initDb, getDb, closeDb, updateProjectAccess, getProject, setProjectStatus, getIdleProjects, logAccess, getAccessLogs, cleanOldLogs, } from "./utils/db.js";
 export { loadProjectConfig, shouldNeverStop, getIdleTimeoutMs, } from "./utils/project-config.js";
 export type { ProjectConfig } from "./utils/project-config.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,WAAW,EACX,UAAU,EACV,QAAQ,EACR,WAAW,EACX,UAAU,EACV,WAAW,EACX,aAAa,EACb,SAAS,GACV,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAG9E,OAAO,EACL,SAAS,EACT,OAAO,EACP,aAAa,EACb,cAAc,EACd,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,WAAW,EACX,YAAY,GACb,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,MAAM,EACN,KAAK,EACL,OAAO,EACP,mBAAmB,EACnB,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,SAAS,EACT,aAAa,EACb,YAAY,GACb,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAG/D,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG5E,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,WAAW,EACX,UAAU,EACV,QAAQ,EACR,WAAW,EACX,UAAU,EACV,WAAW,EACX,aAAa,EACb,SAAS,GACV,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAG9E,OAAO,EACL,SAAS,EACT,OAAO,EACP,aAAa,EACb,cAAc,EACd,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,WAAW,EACX,YAAY,GACb,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,MAAM,EACN,KAAK,EACL,OAAO,EACP,mBAAmB,EACnB,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,SAAS,EACT,aAAa,EACb,YAAY,GACb,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAG/D,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG5E,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -1,3 +1,3 @@
-import { a as printAuditResults, c as stopIdleProjects, d as validateConfig, l as loadConfig, n as setup, o as runAudit, s as startIdleScheduler, t as audit, u as parseDuration } from "./setup-DHhQF7wW.js";
-import { A as initDb, B as stopProject, C as shouldNeverStop, D as getDb, E as getAccessLogs, F as getProjectFromHostname, G as parseBasicAuth, H as checkAuth, I as getProjectInfo, K as parseBearerToken, L as listProjects, M as setProjectStatus, N as updateProjectAccess, O as getIdleProjects, P as buildHostnameIndex, R as loadProjectList, S as loadProjectConfig, T as closeDb, U as matchHostname, V as watchProjectList, W as matchIp, j as logAccess, k as getProject, n as startServer, w as cleanOldLogs, x as getIdleTimeoutMs, z as startProject } from "./server-CLrB1zpR.js";
-export { audit, buildHostnameIndex, checkAuth, cleanOldLogs, closeDb, getAccessLogs, getDb, getIdleProjects, getIdleTimeoutMs, getProject, getProjectFromHostname, getProjectInfo, initDb, listProjects, loadConfig, loadProjectConfig, loadProjectList, logAccess, matchHostname, matchIp, parseBasicAuth, parseBearerToken, parseDuration, printAuditResults, runAudit, setProjectStatus, setup, shouldNeverStop, startIdleScheduler, startProject, startServer, stopIdleProjects, stopProject, updateProjectAccess, validateConfig, watchProjectList };
+import { a as printAuditResults, c as stopIdleProjects, d as buildDockerFirewallScript, f as buildDockerFirewallUnit, g as validateConfig, h as parseDuration, l as DOCKER_FIREWALL_SCRIPT, m as loadConfig, n as setup, o as runAudit, p as configureDockerFirewall, s as startIdleScheduler, t as audit, u as DOCKER_FIREWALL_UNIT } from "./setup-BFU-DlX3.js";
+import { B as startProject, C as updateProjectAccess, F as buildHostnameIndex, G as matchIp, H as watchProjectList, I as getProjectFromHostname, K as parseBasicAuth, L as getProjectInfo, R as listProjects, S as setProjectStatus, U as checkAuth, V as stopProject, W as matchHostname, _ as getDb, b as initDb, d as getIdleTimeoutMs, f as loadProjectConfig, g as getAccessLogs, h as closeDb, m as cleanOldLogs, n as startServer, p as shouldNeverStop, q as parseBearerToken, v as getIdleProjects, x as logAccess, y as getProject, z as loadProjectList } from "./server-CvSztHW2.js";
+export { DOCKER_FIREWALL_SCRIPT, DOCKER_FIREWALL_UNIT, audit, buildDockerFirewallScript, buildDockerFirewallUnit, buildHostnameIndex, checkAuth, cleanOldLogs, closeDb, configureDockerFirewall, getAccessLogs, getDb, getIdleProjects, getIdleTimeoutMs, getProject, getProjectFromHostname, getProjectInfo, initDb, listProjects, loadConfig, loadProjectConfig, loadProjectList, logAccess, matchHostname, matchIp, parseBasicAuth, parseBearerToken, parseDuration, printAuditResults, runAudit, setProjectStatus, setup, shouldNeverStop, startIdleScheduler, startProject, startServer, stopIdleProjects, stopProject, updateProjectAccess, validateConfig, watchProjectList };

package/dist/{server-CLrB1zpR.js → server-CvSztHW2.js}

@@ -394,6 +394,131 @@ function listProjects() {
 	}
 }
 //#endregion
+//#region src/setup/steps.ts
+var stepNumber = 0;
+var dryRun = false;
+/**
+* Set dry-run mode
+*/
+function setDryRun(value) {
+	dryRun = value;
+}
+/**
+* Reset step counter
+*/
+function resetSteps() {
+	stepNumber = 0;
+}
+/**
+* Log a step
+*/
+function step(message) {
+	stepNumber++;
+	console.log(`\n\x1b[36m[${stepNumber}]\x1b[0m ${message}`);
+}
+/**
+* Log success
+*/
+function success(message) {
+	console.log(`    \x1b[32m✓\x1b[0m ${message}`);
+}
+/**
+* Log warning
+*/
+function warn(message) {
+	console.log(`    \x1b[33m⚠\x1b[0m ${message}`);
+}
+/**
+* Log error
+*/
+function error(message) {
+	console.log(`    \x1b[31m✗\x1b[0m ${message}`);
+}
+/**
+* Log info
+*/
+function info(message) {
+	console.log(`    ${message}`);
+}
+/**
+* Execute a command (or show in dry-run mode)
+*/
+function exec(command, options) {
+	if (dryRun) {
+		if (!options?.silent) console.log(`    \x1b[90m$ ${command}\x1b[0m`);
+		return "";
+	}
+	try {
+		return execSync(command, {
+			encoding: "utf-8",
+			stdio: options?.silent ? "pipe" : "inherit"
+		});
+	} catch (err) {
+		throw new Error(`Command failed: ${command}\n${err.stderr ?? ""}`);
+	}
+}
+/**
+* Execute a command and return output (silent)
+*/
+function execSilent(command) {
+	if (dryRun) return "";
+	try {
+		return execSync(command, {
+			encoding: "utf-8",
+			stdio: "pipe"
+		}).trim();
+	} catch {
+		return "";
+	}
+}
+/**
+* Check if a command exists
+*/
+function commandExists(command) {
+	try {
+		execSync(`which ${command}`, { stdio: "pipe" });
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Check if running as root
+*/
+function isRoot() {
+	return process.getuid?.() === 0;
+}
+/**
+* Write a file (or show in dry-run mode)
+*/
+function writeFile(path, content) {
+	if (dryRun) {
+		console.log(`    \x1b[90mWrite ${path}:\x1b[0m`);
+		const lines = content.split("\n").slice(0, 5);
+		for (const line of lines) console.log(`    \x1b[90m  ${line}\x1b[0m`);
+		if (content.split("\n").length > 5) console.log(`    \x1b[90m  ...\x1b[0m`);
+		return;
+	}
+	writeFileSync(path, content);
+}
+//#endregion
+//#region src/setup/io.ts
+/**
+* The real implementation, used when no io is injected.
+*
+* `writeFile` comes from steps.js rather than `node:fs` so writes are
+* skipped in dry-run mode. Reads stay direct: they change nothing.
+*/
+var nodeIo = {
+	exec,
+	execSilent,
+	commandExists,
+	writeFile,
+	fileExists: existsSync,
+	readFile: (path) => readFileSync(path, "utf-8"),
+	env: process.env
+};
+//#endregion
 //#region src/utils/db.ts
 var db = null;
 /**
@@ -574,131 +699,6 @@ function getIdleTimeoutMs(config) {
 	return ms > 0 ? ms : void 0;
 }
 //#endregion
-//#region src/setup/steps.ts
-var stepNumber = 0;
-var dryRun = false;
-/**
-* Set dry-run mode
-*/
-function setDryRun(value) {
-	dryRun = value;
-}
-/**
-* Reset step counter
-*/
-function resetSteps() {
-	stepNumber = 0;
-}
-/**
-* Log a step
-*/
-function step(message) {
-	stepNumber++;
-	console.log(`\n\x1b[36m[${stepNumber}]\x1b[0m ${message}`);
-}
-/**
-* Log success
-*/
-function success(message) {
-	console.log(`    \x1b[32m✓\x1b[0m ${message}`);
-}
-/**
-* Log warning
-*/
-function warn(message) {
-	console.log(`    \x1b[33m⚠\x1b[0m ${message}`);
-}
-/**
-* Log error
-*/
-function error(message) {
-	console.log(`    \x1b[31m✗\x1b[0m ${message}`);
-}
-/**
-* Log info
-*/
-function info(message) {
-	console.log(`    ${message}`);
-}
-/**
-* Execute a command (or show in dry-run mode)
-*/
-function exec(command, options) {
-	if (dryRun) {
-		if (!options?.silent) console.log(`    \x1b[90m$ ${command}\x1b[0m`);
-		return "";
-	}
-	try {
-		return execSync(command, {
-			encoding: "utf-8",
-			stdio: options?.silent ? "pipe" : "inherit"
-		});
-	} catch (err) {
-		throw new Error(`Command failed: ${command}\n${err.stderr ?? ""}`);
-	}
-}
-/**
-* Execute a command and return output (silent)
-*/
-function execSilent(command) {
-	if (dryRun) return "";
-	try {
-		return execSync(command, {
-			encoding: "utf-8",
-			stdio: "pipe"
-		}).trim();
-	} catch {
-		return "";
-	}
-}
-/**
-* Check if a command exists
-*/
-function commandExists(command) {
-	try {
-		execSync(`which ${command}`, { stdio: "pipe" });
-		return true;
-	} catch {
-		return false;
-	}
-}
-/**
-* Check if running as root
-*/
-function isRoot() {
-	return process.getuid?.() === 0;
-}
-/**
-* Write a file (or show in dry-run mode)
-*/
-function writeFile(path, content) {
-	if (dryRun) {
-		console.log(`    \x1b[90mWrite ${path}:\x1b[0m`);
-		const lines = content.split("\n").slice(0, 5);
-		for (const line of lines) console.log(`    \x1b[90m  ${line}\x1b[0m`);
-		if (content.split("\n").length > 5) console.log(`    \x1b[90m  ...\x1b[0m`);
-		return;
-	}
-	writeFileSync(path, content);
-}
-//#endregion
-//#region src/setup/io.ts
-/**
-* The real implementation, used when no io is injected.
-*
-* `writeFile` comes from steps.js rather than `node:fs` so writes are
-* skipped in dry-run mode. Reads stay direct: they change nothing.
-*/
-var nodeIo = {
-	exec,
-	execSilent,
-	commandExists,
-	writeFile,
-	fileExists: existsSync,
-	readFile: (path) => readFileSync(path, "utf-8"),
-	env: process.env
-};
-//#endregion
 //#region src/setup/ddev.ts
 /**
 * Install system dependencies required by Trafic
@@ -1209,6 +1209,6 @@ function startServer(agentConfig) {
 	});
 }
 //#endregion
-export { initDb as A, stopProject as B, shouldNeverStop as C, getDb as D, getAccessLogs as E, getProjectFromHostname as F, parseBasicAuth as G, checkAuth as H, getProjectInfo as I, parseBearerToken as K, listProjects as L, setProjectStatus as M, updateProjectAccess as N, getIdleProjects as O, buildHostnameIndex as P, loadProjectList as R, loadProjectConfig as S, closeDb as T, matchHostname as U, watchProjectList as V, matchIp as W, setDryRun as _, configureTraefik as a, warn as b, installSystemDeps as c, error as d, exec as f, resetSteps as g, isRoot as h, configureDdev as i, logAccess as j, getProject as k, purgeTraefikAcmeStorage as l, info as m, startServer as n, getDockerGatewayIp as o, execSilent as p, addDdevAptRepo as r, installDdev as s, routePath as t, nodeIo as u, step as v, cleanOldLogs as w, getIdleTimeoutMs as x, success as y, startProject as z };
+export { resetSteps as A, startProject as B, updateProjectAccess as C, execSilent as D, exec as E, buildHostnameIndex as F, matchIp as G, watchProjectList as H, getProjectFromHostname as I, parseBasicAuth as K, getProjectInfo as L, step as M, success as N, info as O, warn as P, listProjects as R, setProjectStatus as S, error as T, checkAuth as U, stopProject as V, matchHostname as W, getDb as _, configureTraefik as a, initDb as b, installSystemDeps as c, getIdleTimeoutMs as d, loadProjectConfig as f, getAccessLogs as g, closeDb as h, configureDdev as i, setDryRun as j, isRoot as k, purgeTraefikAcmeStorage as l, cleanOldLogs as m, startServer as n, getDockerGatewayIp as o, shouldNeverStop as p, parseBearerToken as q, addDdevAptRepo as r, installDdev as s, routePath as t, readToolPorts as u, getIdleProjects as v, nodeIo as w, logAccess as x, getProject as y, loadProjectList as z };
 
-//# sourceMappingURL=server-CLrB1zpR.js.map
+//# sourceMappingURL=server-CvSztHW2.js.map