@studiometa/trafic-agent 0.1.45 → 0.1.47

package/dist/{server-BAjHxgqh.js → server-EPU5dtPx.js}

@@ -1,9 +1,147 @@
 import { existsSync, readFileSync, watch, writeFileSync } from "node:fs";
+import { parse } from "smol-toml";
 import { execFile, execSync } from "node:child_process";
 import { DatabaseSync } from "node:sqlite";
 import { dirname, join, resolve } from "node:path";
 import { createServer } from "node:http";
 import { fileURLToPath } from "node:url";
+//#region src/utils/config.ts
+var DEFAULT_CONFIG_PATHS = [
+	"/etc/trafic/config.toml",
+	"./config.toml",
+	"./trafic.toml"
+];
+var DEFAULT_CONFIG = {
+	tld: "",
+	port: 9876,
+	dbPath: "/var/lib/trafic/db.sqlite",
+	projectListPath: "/home/ddev/.ddev/project_list.yaml",
+	projectsDir: "/home/ddev/www",
+	idleTimeout: "30m",
+	idleCheckInterval: "5m",
+	auth: {
+		defaultPolicy: "basic",
+		allowedIps: [],
+		tokens: [],
+		basicAuth: [],
+		rules: [],
+		trustedProxyHops: 1
+	},
+	tls: { dnsEnv: {} }
+};
+/**
+* Parse a duration string (e.g., "30m", "1h", "2h30m") to milliseconds
+*/
+function parseDuration(duration) {
+	const match = duration.match(/(?:(\d+)h)?(?:(\d+)m)?(?:(\d+)s)?/);
+	if (!match) return 0;
+	const hours = parseInt(match[1] ?? "0", 10);
+	const minutes = parseInt(match[2] ?? "0", 10);
+	const seconds = parseInt(match[3] ?? "0", 10);
+	return (hours * 3600 + minutes * 60 + seconds) * 1e3;
+}
+/**
+* Load configuration from TOML file
+*/
+function loadConfig(configPath) {
+	let path = configPath;
+	if (!path) path = DEFAULT_CONFIG_PATHS.find((p) => existsSync(p));
+	if (!path || !existsSync(path)) {
+		console.warn("No config file found, using defaults");
+		return DEFAULT_CONFIG;
+	}
+	const content = readFileSync(path, "utf-8");
+	const parsed = parse(content);
+	const auth = mergeAuthConfig(parsed.auth);
+	const tls = mergeTlsConfig(parsed.tls);
+	return {
+		tld: parsed.tld ?? DEFAULT_CONFIG.tld,
+		port: parsed.port ?? DEFAULT_CONFIG.port,
+		dbPath: parsed.db_path ?? DEFAULT_CONFIG.dbPath,
+		projectListPath: parsed.project_list_path ?? DEFAULT_CONFIG.projectListPath,
+		projectsDir: parsed.projects_dir ?? DEFAULT_CONFIG.projectsDir,
+		idleTimeout: parsed.idle_timeout ?? DEFAULT_CONFIG.idleTimeout,
+		idleCheckInterval: parsed.idle_check_interval ?? DEFAULT_CONFIG.idleCheckInterval,
+		auth,
+		tls
+	};
+}
+/**
+* Read the [tls] section.
+*
+* `dns_env` holds provider credentials, so its values are taken as-is and
+* only checked for being strings — validateConfig reports the rest.
+*/
+function mergeTlsConfig(raw) {
+	if (!raw) return DEFAULT_CONFIG.tls;
+	const env = raw.dns_env ?? {};
+	const dnsEnv = {};
+	for (const [key, value] of Object.entries(env)) dnsEnv[key] = value;
+	return {
+		dnsProvider: raw.dns_provider || void 0,
+		caServer: raw.ca_server || void 0,
+		dnsEnv
+	};
+}
+/**
+* Parse basic_auth entries from TOML.
+* Accepts either plain strings ("user:pass") or objects ({username, password}).
+*/
+function parseBasicAuthEntries(raw) {
+	if (!Array.isArray(raw)) return null;
+	return raw.map((entry) => {
+		if (typeof entry === "string") return entry;
+		if (typeof entry === "object" && entry !== null) {
+			const { username, password } = entry;
+			return `${username}:${password}`;
+		}
+		return String(entry);
+	});
+}
+function mergeAuthConfig(raw) {
+	if (!raw) return DEFAULT_CONFIG.auth;
+	const rules = raw.rules ?? [];
+	return {
+		defaultPolicy: raw.default_policy ?? DEFAULT_CONFIG.auth.defaultPolicy,
+		allowedIps: raw.allowed_ips ?? DEFAULT_CONFIG.auth.allowedIps,
+		tokens: raw.tokens ?? DEFAULT_CONFIG.auth.tokens,
+		basicAuth: parseBasicAuthEntries(raw.basic_auth) ?? DEFAULT_CONFIG.auth.basicAuth,
+		rules: rules.map((r) => ({
+			match: r.match,
+			policy: r.policy,
+			tokens: r.tokens,
+			allowedIps: r.allowed_ips
+		})),
+		trustedProxyHops: parseTrustedProxyHops(raw.trusted_proxy_hops)
+	};
+}
+/**
+* Parse trusted_proxy_hops, ignoring values that cannot be a hop count.
+*
+* A bad value falls back to the default rather than 0, because 0 would read
+* the socket peer — always the proxy — and quietly stop the IP allowlist and
+* per-hostname IP rules from ever matching.
+*/
+function parseTrustedProxyHops(raw) {
+	const hops = typeof raw === "number" ? raw : Number(raw);
+	if (!Number.isInteger(hops) || hops < 1) return DEFAULT_CONFIG.auth.trustedProxyHops;
+	return hops;
+}
+/**
+* Validate configuration
+*/
+function validateConfig(config) {
+	const errors = [];
+	if (!config.tld) errors.push("tld is required");
+	if (config.port < 1 || config.port > 65535) errors.push("port must be between 1 and 65535");
+	if (config.auth.defaultPolicy !== "allow" && config.auth.defaultPolicy !== "deny" && config.auth.defaultPolicy !== "basic" && config.auth.defaultPolicy !== "token") errors.push("auth.default_policy must be \"allow\", \"deny\", \"basic\", or \"token\"");
+	for (const [key, value] of Object.entries(config.tls.dnsEnv)) {
+		if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) errors.push(`tls.dns_env key "${key}" is not a valid environment variable name`);
+		if (typeof value !== "string") errors.push(`tls.dns_env.${key} must be a string`);
+	}
+	return errors;
+}
+//#endregion
 //#region src/utils/auth.ts
 /**
 * Check if an IP matches a pattern (supports CIDR notation)
@@ -832,14 +970,42 @@ function readRouterPorts(io = nodeIo) {
 		https: read("router-https-port", DEFAULT_ROUTER_PORTS.https)
 	};
 }
+/** Where the agent writes the Traefik files it owns. */
+var TRAEFIK_DIR = "/home/ddev/.ddev/traefik";
+/** Static config the agent owns, merged by DDEV into .static_config.yaml. */
+var STATIC_CONFIG = `${TRAEFIK_DIR}/static_config.trafic.yaml`;
+/** Wildcard TLS store, read before DDEV's own default_config.yaml. */
+var TLS_STORE_CONFIG = `${TRAEFIK_DIR}/custom-global-config/0-trafic-tls.yaml`;
+/** Router compose override carrying the DNS provider credentials. */
+var ROUTER_COMPOSE_OVERRIDE = "/home/ddev/.ddev/router-compose.trafic.yaml";
+/** Name of the DNS-01 resolver the agent adds to Traefik. */
+var DNS_RESOLVER = "acme-dns";
 /**
 * Build the static config attaching forward auth to every entry point.
 *
 * The error page middleware stays on the web entry points only: a 502 from a
 * stopped project should show the waiting page, while a tool port has nothing
 * to wait for.
-*/
-function buildStaticConfig(toolPorts, routerPorts = DEFAULT_ROUTER_PORTS) {
+*
+* With `tls`, a DNS-01 certificate resolver is added. It is only ever used by
+* the default TLS store (see buildTlsStoreConfig): DDEV keeps writing
+* `certResolver: acme-tlsChallenge` on every project router, and Traefik
+* skips those requests once the default store holds a certificate matching
+* the host with wildcard semantics.
+*
+* The propagation check is disabled on purpose. lego sets two TXT values at
+* the same name, one for `<tld>` and one for `*.<tld>`, then asks public
+* resolvers for each. A resolver that answered between the two writes caches
+* the partial answer for the record TTL — 120s on Cloudflare, longer than
+* lego's check window — and the order fails with "NS 9.9.9.9:53 did not
+* return the expected TXT record" although both records were correct. That
+* was seen on a live server; the staging run had passed by timing luck.
+* Let's Encrypt resolves authoritatively itself, so the check adds a failure
+* mode without adding safety. `PropagationWait(delay, skipCheck)` sleeps the
+* delay and then skips the check, so the 30s covers propagation to the
+* provider's edges before the CA looks.
+*/
+function buildStaticConfig(toolPorts, routerPorts = DEFAULT_ROUTER_PORTS, tls) {
 	const webEntryPoint = (name) => `  ${name}:
     http:
       middlewares:
@@ -853,8 +1019,66 @@ function buildStaticConfig(toolPorts, routerPorts = DEFAULT_ROUTER_PORTS) {
 `;
 	const web = [routerPorts.http, routerPorts.https];
 	const tools = toolPorts.filter((port) => !web.includes(port));
-	return `entryPoints:
+	const entryPoints = `entryPoints:
 ${web.map((port) => webEntryPoint(`http-${port}`)).join("")}${tools.map(toolEntryPoint).join("")}`;
+	if (!tls) return entryPoints;
+	return `${entryPoints}
+certificatesResolvers:
+  ${DNS_RESOLVER}:
+    acme:
+      email: "${escapeYamlDouble(tls.email)}"
+      storage: /mnt/ddev-global-cache/traefik/${DNS_RESOLVER}.json
+${tls.caServer ? `      caServer: "${escapeYamlDouble(tls.caServer)}"\n` : ""}      dnsChallenge:
+        provider: "${escapeYamlDouble(tls.provider)}"
+        propagation:
+          delayBeforeChecks: 30s
+          disableChecks: true
+`;
+}
+/**
+* Build the default TLS store holding the wildcard certificate.
+*
+* Traefik's file provider keeps the first `tls.stores.default` it reads in
+* directory order and logs "TLS store default already configured, skipping"
+* for every later file. DDEV writes an empty one in `default_config.yaml`,
+* so this has to be read first — hence the `0-` prefix on the file name.
+*/
+function buildTlsStoreConfig(tld) {
+	return `# Trafic: wildcard certificate served to every host without its own
+#
+# Read before DDEV's default_config.yaml — Traefik keeps the first default
+# store it sees, so the file name has to sort first.
+tls:
+  stores:
+    default:
+      defaultGeneratedCert:
+        resolver: ${DNS_RESOLVER}
+        domain:
+          main: "${escapeYamlDouble(tld)}"
+          sans:
+            - "*.${escapeYamlDouble(tld)}"
+`;
+}
+/**
+* Build the router compose override carrying the provider credentials.
+*
+* lego reads them from the router container's environment, so they cannot be
+* passed through a config file. DDEV merges `~/.ddev/router-compose.*.yaml`
+* into the router compose and recreates the container when it changes, on the
+* next `ddev start`.
+*/
+function buildRouterComposeOverride(env) {
+	return `# Trafic: DNS-01 provider credentials for the Traefik router
+# Contains secrets — this file is mode 600.
+services:
+  ddev-router:
+    environment:
+${Object.entries(env).map(([key, value]) => `      - "${key}=${escapeYamlDouble(value)}"`).join("\n")}
+`;
+}
+/** Escape a value for a double-quoted YAML scalar. */
+function escapeYamlDouble(value) {
+	return value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
 }
 /**
 * Build the dynamic config: the middlewares, the agent service, and the
@@ -887,12 +1111,20 @@ http:
         query: "/"
 
   routers:
-    # Lowest priority, so a DDEV project router always wins. These only match
-    # when none does — which is what a stopped project produces, because DDEV
-    # removes that project's router and Traefik would otherwise answer 404.
-    # Without them the waiting page never appears and scale-to-zero never
-    # restarts anything. Auth is unaffected: it is attached at the entry
-    # point, not here, so this cannot reintroduce the bypass that #27 fixed.
+    # The lowest priority above DDEV's own fallback routers, which sit at
+    # priority 1 since DDEV 1.25.4, and still far below any project router —
+    # so a DDEV project router always wins. These only match when none does —
+    # which is what a stopped project produces, because DDEV removes that
+    # project's router and Traefik would otherwise answer 404. Without them
+    # the waiting page never appears and scale-to-zero never restarts
+    # anything. Auth is unaffected: it is attached at the entry point, not
+    # here, so this cannot reintroduce the bypass that #27 fixed.
+    #
+    # Priority 1 is not enough any more: DDEV 1.25.4 ships
+    # ddev-router-fallback-http and ddev-router-fallback-https with the same
+    # PathPrefix(\`/\`) rule at priority 1, pointing at a 404 responder. With
+    # equal priority and identical rules Traefik picked DDEV's, so a stopped
+    # project answered DDEV's 404 page instead of the waiting page.
     #
     # Each names exactly one entry point. Leaving entryPoints out attaches a
     # router to all of them, which breaks DDEV's router health check — it
@@ -901,7 +1133,7 @@ http:
       rule: "PathPrefix(\`/\`)"
       entryPoints:
         - http-${routerPorts.http}
-      priority: 1
+      priority: 2
       service: trafic-service
 
     # Carries tls, so it only matches the https entry point. The plain one
@@ -910,7 +1142,7 @@ http:
       rule: "PathPrefix(\`/\`)"
       entryPoints:
         - http-${routerPorts.https}
-      priority: 1
+      priority: 2
       service: trafic-service
       tls: {}
 
@@ -922,23 +1154,108 @@ http:
 `;
 }
 /**
-* Configure Traefik for forward auth
+* Read DDEV's Let's Encrypt settings.
+*
+* DDEV owns them — `ddev config global --use-letsencrypt --letsencrypt-email`
+* — so they are the single source of truth for the ACME account, wildcard
+* mode included.
 */
-function configureTraefik(io = nodeIo) {
+function readLetsEncryptSettings(io = nodeIo) {
+	const output = io.execSilent("su - ddev -c 'ddev config global'");
+	return {
+		enabled: /^use-letsencrypt=true$/m.test(output),
+		email: /^letsencrypt-email=(.+)$/m.exec(output)?.[1]?.trim() || void 0
+	};
+}
+/** Read the project TLD from DDEV's global config. */
+function readProjectTld(io = nodeIo) {
+	const output = io.execSilent("su - ddev -c 'ddev config global'");
+	return /^project-tld=(.+)$/m.exec(output)?.[1]?.trim() ?? "";
+}
+/**
+* Configure Traefik for forward auth, and for the wildcard certificate when
+* a DNS provider is configured.
+*
+* Everything the agent owns in Traefik's configuration is written here, so
+* setup and the migrations share one code path and cannot drift apart.
+*/
+function configureTraefik(options = {}, io = nodeIo) {
 	step("Configure Traefik for forward auth");
-	io.exec("mkdir -p /home/ddev/.ddev/traefik/custom-global-config", { silent: true });
+	io.exec(`mkdir -p ${TRAEFIK_DIR}/custom-global-config`, { silent: true });
 	io.exec("chown -R ddev:ddev /home/ddev/.ddev", { silent: true });
 	const gatewayIp = getDockerGatewayIp(io);
 	const routerPorts = readRouterPorts(io);
 	const dynamicConfig = buildDynamicConfig(gatewayIp, routerPorts);
-	io.writeFile("/home/ddev/.ddev/traefik/custom-global-config/trafic.yaml", dynamicConfig);
-	io.exec("chown ddev:ddev /home/ddev/.ddev/traefik/custom-global-config/trafic.yaml", { silent: true });
-	const staticConfig = buildStaticConfig(readToolPorts(io), routerPorts);
-	io.writeFile("/home/ddev/.ddev/traefik/static_config.trafic.yaml", staticConfig);
-	io.exec("chown ddev:ddev /home/ddev/.ddev/traefik/static_config.trafic.yaml", { silent: true });
+	io.writeFile(`${TRAEFIK_DIR}/custom-global-config/trafic.yaml`, dynamicConfig);
+	io.exec(`chown ddev:ddev ${TRAEFIK_DIR}/custom-global-config/trafic.yaml`, { silent: true });
+	const tls = options.tls ?? loadConfig().tls;
+	const resolver = tls.dnsProvider ? buildTlsResolverOptions(tls, io) : void 0;
+	const tld = resolver ? readWildcardTld(options.tld, io) : "";
+	const staticConfig = buildStaticConfig(readToolPorts(io), routerPorts, resolver);
+	io.writeFile(STATIC_CONFIG, staticConfig);
+	io.exec(`chown ddev:ddev ${STATIC_CONFIG}`, { silent: true });
 	info(`Entry points: http-${routerPorts.http}, http-${routerPorts.https} (web) plus tool ports`);
+	if (resolver) writeWildcardFiles(tls, tld, io);
+	else removeWildcardFiles(io);
 	success("Traefik configured with Trafic middleware");
 }
+/**
+* Name of one running DDEV project, or null when none runs.
+*
+* `ddev list -j` is the only source that knows: `project_list.yaml`, which the
+* agent watches for discovery, records every project DDEV has ever seen but
+* carries no live status — a project stopped an hour ago still sits there.
+* `ddev list -j` asks Docker, and wraps the entries in a `raw` array.
+*
+* Used to push a changed global Traefik config into the running router: DDEV
+* copies `custom-global-config/*.yaml` into it on any `ddev start`, so
+* starting a project that is already running is enough, and nothing that is
+* serving traffic has to be stopped.
+*/
+function findRunningProject(io = nodeIo) {
+	const output = io.execSilent("su - ddev -c 'ddev list -j'");
+	if (!output) return null;
+	try {
+		return (JSON.parse(output).raw ?? []).find((project) => project.status === "running")?.name ?? null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Turn the agent's TLS config into what the static config needs.
+*
+* The ACME account comes from DDEV: a resolver without an email is refused by
+* Let's Encrypt, and `use_letsencrypt=false` means DDEV is also stripping the
+* certificate resolver from the project routers.
+*/
+function buildTlsResolverOptions(tls, io) {
+	const letsEncrypt = readLetsEncryptSettings(io);
+	if (!letsEncrypt.enabled || !letsEncrypt.email) throw new Error("tls.dns_provider needs Let's Encrypt enabled in DDEV with an account email.\n  Run setup again with --email=<address>, or unset tls.dns_provider.");
+	return {
+		provider: tls.dnsProvider,
+		email: letsEncrypt.email,
+		caServer: tls.caServer
+	};
+}
+/** Read the TLD the wildcard certificate covers, or fail before any write. */
+function readWildcardTld(configured, io) {
+	const tld = configured || readProjectTld(io);
+	if (!tld) throw new Error("Cannot configure the wildcard certificate: no project TLD is set in DDEV");
+	return tld;
+}
+/** Write the wildcard TLS store and the router credentials. */
+function writeWildcardFiles(tls, tld, io) {
+	io.writeFile(TLS_STORE_CONFIG, buildTlsStoreConfig(tld));
+	io.exec(`chown ddev:ddev ${TLS_STORE_CONFIG}`, { silent: true });
+	io.exec(`install -m 600 -o ddev -g ddev /dev/null ${ROUTER_COMPOSE_OVERRIDE}`, { silent: true });
+	io.writeFile(ROUTER_COMPOSE_OVERRIDE, buildRouterComposeOverride(tls.dnsEnv));
+	success(`Wildcard certificate: *.${tld} via the ${tls.dnsProvider} DNS-01 provider`);
+}
+/** Remove the wildcard files where no DNS provider is configured. */
+function removeWildcardFiles(io) {
+	if (io.fileExists(TLS_STORE_CONFIG)) io.exec(`rm -f ${TLS_STORE_CONFIG}`, { silent: true });
+	if (io.fileExists("/home/ddev/.ddev/router-compose.trafic.yaml")) io.exec(`rm -f ${ROUTER_COMPOSE_OVERRIDE}`, { silent: true });
+}
 //#endregion
 //#region src/utils/traefik.ts
 /**
@@ -999,6 +1316,22 @@ function syncForwardAuthAddress(projectListPath, io = nodeIo) {
 	}
 }
 //#endregion
+//#region src/utils/tls.ts
+/**
+* Warn when the config asks for a wildcard certificate that Traefik never got.
+*
+* The files are written by setup and by migration 0016, not by the running
+* agent: writing them needs root, and applying them needs a project start.
+* So this only reports, and says which command fixes it.
+*/
+function warnIfWildcardNotApplied(config, staticConfigPath = STATIC_CONFIG) {
+	if (!config.tls.dnsProvider) return false;
+	if (existsSync(staticConfigPath) && readFileSync(staticConfigPath, "utf-8").includes(`acme-dns:`)) return false;
+	console.warn(`tls.dns_provider is set to "${config.tls.dnsProvider}" but Traefik has no ${DNS_RESOLVER} resolver.`);
+	console.warn("  The wildcard certificate is not being requested. Run `sudo trafic-agent upgrade`, or re-run setup.");
+	return true;
+}
+//#endregion
 //#region src/server.ts
 var __dirname = dirname(fileURLToPath(import.meta.url));
 var config;
@@ -1180,6 +1513,7 @@ function startServer(agentConfig) {
 	config = agentConfig;
 	initDb(config.dbPath);
 	syncForwardAuthAddress(config.projectListPath);
+	warnIfWildcardNotApplied(config);
 	reloadProjects();
 	watchProjectList(config.projectListPath, () => {
 		console.log("Project list changed, reloading...");
@@ -1212,6 +1546,6 @@ function startServer(agentConfig) {
 	});
 }
 //#endregion
-export { error as A, buildHostnameIndex as B, getIdleProjects as C, setProjectStatus as D, logAccess as E, resetSteps as F, startProject as G, getProjectInfo as H, setDryRun as I, checkAuth as J, stopProject as K, step as L, execSilent as M, info as N, updateProjectAccess as O, isRoot as P, parseBearerToken as Q, success as R, getDb as S, initDb as T, listProjects as U, getProjectFromHostname as V, loadProjectList as W, matchIp as X, matchHostname as Y, parseBasicAuth as Z, loadProjectConfig as _, handleStatus as a, closeDb as b, addDdevAptRepo as c, getDockerGatewayIp as d, installDdev as f, getIdleTimeoutMs as g, readToolPorts as h, handleRequest as i, exec as j, nodeIo as k, configureDdev as l, purgeTraefikAcmeStorage as m, handleAuth as n, routePath as o, installSystemDeps as p, watchProjectList as q, handleErrors as r, startServer as s, getEffectiveAuthConfig as t, configureTraefik as u, shouldNeverStop as v, getProject as w, getAccessLogs as x, cleanOldLogs as y, warn as z };
+export { checkAuth as $, initDb as A, resetSteps as B, shouldNeverStop as C, getDb as D, getAccessLogs as E, error as F, buildHostnameIndex as G, step as H, exec as I, listProjects as J, getProjectFromHostname as K, execSilent as L, setProjectStatus as M, updateProjectAccess as N, getIdleProjects as O, nodeIo as P, watchProjectList as Q, info as R, loadProjectConfig as S, closeDb as T, success as U, setDryRun as V, warn as W, startProject as X, loadProjectList as Y, stopProject as Z, installDdev as _, handleStatus as a, parseDuration as at, readToolPorts as b, DNS_RESOLVER as c, TLS_STORE_CONFIG as d, matchHostname as et, addDdevAptRepo as f, getDockerGatewayIp as g, findRunningProject as h, handleRequest as i, loadConfig as it, logAccess as j, getProject as k, ROUTER_COMPOSE_OVERRIDE as l, configureTraefik as m, handleAuth as n, parseBasicAuth as nt, routePath as o, validateConfig as ot, configureDdev as p, getProjectInfo as q, handleErrors as r, parseBearerToken as rt, startServer as s, getEffectiveAuthConfig as t, matchIp as tt, STATIC_CONFIG as u, installSystemDeps as v, cleanOldLogs as w, getIdleTimeoutMs as x, purgeTraefikAcmeStorage as y, isRoot as z };
 
-//# sourceMappingURL=server-BAjHxgqh.js.map
+//# sourceMappingURL=server-EPU5dtPx.js.map