@studiometa/trafic-agent 0.1.45 → 0.1.47

package/dist/{setup-BrMbM8w4.js → setup-4zlNJqDe.js}

@@ -1,120 +1,5 @@
-import { A as error, C as getIdleProjects, D as setProjectStatus, F as resetSteps, H as getProjectInfo, I as setDryRun, K as stopProject, L as step, M as execSilent$1, N as info, P as isRoot, R as success, W as loadProjectList, _ as loadProjectConfig, c as addDdevAptRepo, d as getDockerGatewayIp, f as installDdev, g as getIdleTimeoutMs, h as readToolPorts, j as exec, k as nodeIo, l as configureDdev, m as purgeTraefikAcmeStorage, p as installSystemDeps, u as configureTraefik, v as shouldNeverStop, z as warn } from "./server-BAjHxgqh.js";
+import { B as resetSteps, C as shouldNeverStop, F as error, H as step, I as exec, L as execSilent, M as setProjectStatus, O as getIdleProjects, P as nodeIo, R as info, S as loadProjectConfig, U as success, V as setDryRun, W as warn, Y as loadProjectList, Z as stopProject, _ as installDdev, at as parseDuration, b as readToolPorts, d as TLS_STORE_CONFIG, f as addDdevAptRepo, g as getDockerGatewayIp, h as findRunningProject, it as loadConfig, l as ROUTER_COMPOSE_OVERRIDE, m as configureTraefik, p as configureDdev, q as getProjectInfo, u as STATIC_CONFIG, v as installSystemDeps, x as getIdleTimeoutMs, y as purgeTraefikAcmeStorage, z as isRoot } from "./server-EPU5dtPx.js";
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { parse } from "smol-toml";
-import { execSync } from "node:child_process";
-//#region src/utils/config.ts
-var DEFAULT_CONFIG_PATHS = [
-	"/etc/trafic/config.toml",
-	"./config.toml",
-	"./trafic.toml"
-];
-var DEFAULT_CONFIG = {
-	tld: "",
-	port: 9876,
-	dbPath: "/var/lib/trafic/db.sqlite",
-	projectListPath: "/home/ddev/.ddev/project_list.yaml",
-	projectsDir: "/home/ddev/www",
-	idleTimeout: "30m",
-	idleCheckInterval: "5m",
-	auth: {
-		defaultPolicy: "basic",
-		allowedIps: [],
-		tokens: [],
-		basicAuth: [],
-		rules: [],
-		trustedProxyHops: 1
-	}
-};
-/**
-* Parse a duration string (e.g., "30m", "1h", "2h30m") to milliseconds
-*/
-function parseDuration(duration) {
-	const match = duration.match(/(?:(\d+)h)?(?:(\d+)m)?(?:(\d+)s)?/);
-	if (!match) return 0;
-	const hours = parseInt(match[1] ?? "0", 10);
-	const minutes = parseInt(match[2] ?? "0", 10);
-	const seconds = parseInt(match[3] ?? "0", 10);
-	return (hours * 3600 + minutes * 60 + seconds) * 1e3;
-}
-/**
-* Load configuration from TOML file
-*/
-function loadConfig(configPath) {
-	let path = configPath;
-	if (!path) path = DEFAULT_CONFIG_PATHS.find((p) => existsSync(p));
-	if (!path || !existsSync(path)) {
-		console.warn("No config file found, using defaults");
-		return DEFAULT_CONFIG;
-	}
-	const content = readFileSync(path, "utf-8");
-	const parsed = parse(content);
-	const auth = mergeAuthConfig(parsed.auth);
-	return {
-		tld: parsed.tld ?? DEFAULT_CONFIG.tld,
-		port: parsed.port ?? DEFAULT_CONFIG.port,
-		dbPath: parsed.db_path ?? DEFAULT_CONFIG.dbPath,
-		projectListPath: parsed.project_list_path ?? DEFAULT_CONFIG.projectListPath,
-		projectsDir: parsed.projects_dir ?? DEFAULT_CONFIG.projectsDir,
-		idleTimeout: parsed.idle_timeout ?? DEFAULT_CONFIG.idleTimeout,
-		idleCheckInterval: parsed.idle_check_interval ?? DEFAULT_CONFIG.idleCheckInterval,
-		auth
-	};
-}
-/**
-* Parse basic_auth entries from TOML.
-* Accepts either plain strings ("user:pass") or objects ({username, password}).
-*/
-function parseBasicAuthEntries(raw) {
-	if (!Array.isArray(raw)) return null;
-	return raw.map((entry) => {
-		if (typeof entry === "string") return entry;
-		if (typeof entry === "object" && entry !== null) {
-			const { username, password } = entry;
-			return `${username}:${password}`;
-		}
-		return String(entry);
-	});
-}
-function mergeAuthConfig(raw) {
-	if (!raw) return DEFAULT_CONFIG.auth;
-	const rules = raw.rules ?? [];
-	return {
-		defaultPolicy: raw.default_policy ?? DEFAULT_CONFIG.auth.defaultPolicy,
-		allowedIps: raw.allowed_ips ?? DEFAULT_CONFIG.auth.allowedIps,
-		tokens: raw.tokens ?? DEFAULT_CONFIG.auth.tokens,
-		basicAuth: parseBasicAuthEntries(raw.basic_auth) ?? DEFAULT_CONFIG.auth.basicAuth,
-		rules: rules.map((r) => ({
-			match: r.match,
-			policy: r.policy,
-			tokens: r.tokens,
-			allowedIps: r.allowed_ips
-		})),
-		trustedProxyHops: parseTrustedProxyHops(raw.trusted_proxy_hops)
-	};
-}
-/**
-* Parse trusted_proxy_hops, ignoring values that cannot be a hop count.
-*
-* A bad value falls back to the default rather than 0, because 0 would read
-* the socket peer — always the proxy — and quietly stop the IP allowlist and
-* per-hostname IP rules from ever matching.
-*/
-function parseTrustedProxyHops(raw) {
-	const hops = typeof raw === "number" ? raw : Number(raw);
-	if (!Number.isInteger(hops) || hops < 1) return DEFAULT_CONFIG.auth.trustedProxyHops;
-	return hops;
-}
-/**
-* Validate configuration
-*/
-function validateConfig(config) {
-	const errors = [];
-	if (!config.tld) errors.push("tld is required");
-	if (config.port < 1 || config.port > 65535) errors.push("port must be between 1 and 65535");
-	if (config.auth.defaultPolicy !== "allow" && config.auth.defaultPolicy !== "deny" && config.auth.defaultPolicy !== "basic" && config.auth.defaultPolicy !== "token") errors.push("auth.default_policy must be \"allow\", \"deny\", \"basic\", or \"token\"");
-	return errors;
-}
-//#endregion
 //#region src/setup/docker-firewall.ts
 /** Where the rule script lives, so systemd and a human can both run it. */
 var DOCKER_FIREWALL_SCRIPT = "/usr/local/sbin/trafic-docker-firewall";
@@ -341,6 +226,44 @@ function installDocker(io = nodeIo) {
 	io.exec("usermod -aG docker ddev", { silent: true });
 	success("Added ddev user to docker group");
 }
+/** Docker daemon config file */
+var DAEMON_CONFIG = "/etc/docker/daemon.json";
+/**
+* Address pools for the networks Docker creates.
+*
+* Every DDEV project gets its own network. Docker's built-in pools hold only
+* about 31 of them (15 × /16 in 172.17–31.x, 16 × /20 in 192.168.x), so a
+* server with ~30 projects fails with "all predefined address pools have
+* been fully subnetted". /24 subnets in 172.16.0.0/12 give 4096 networks,
+* and keep every network inside the range the firewall rules already allow
+* (hardening.ts, docker-firewall.ts) — the built-in 192.168.x pools are not.
+*/
+var DOCKER_ADDRESS_POOLS = [{
+	base: "172.16.0.0/12",
+	size: 24
+}];
+/**
+* Add the address pools to an existing daemon config.
+*
+* Returns true when the config was changed. Leaves a config that already
+* sets pools alone (an operator choice), and one it cannot parse.
+*/
+function addDockerAddressPools(io = nodeIo) {
+	let config = {};
+	if (io.fileExists("/etc/docker/daemon.json")) try {
+		config = JSON.parse(io.readFile(DAEMON_CONFIG));
+	} catch {
+		warn("Could not parse existing Docker config, skipping");
+		return false;
+	}
+	if ("default-address-pools" in config) return false;
+	io.exec("mkdir -p /etc/docker");
+	io.writeFile(DAEMON_CONFIG, JSON.stringify({
+		...config,
+		"default-address-pools": DOCKER_ADDRESS_POOLS
+	}, null, 2));
+	return true;
+}
 /**
 * Configure Docker for production use
 */
@@ -353,10 +276,11 @@ function configureDocker(io = nodeIo) {
 			"max-file": "3"
 		},
 		"storage-driver": "overlay2",
-		"live-restore": true
+		"live-restore": true,
+		"default-address-pools": DOCKER_ADDRESS_POOLS
 	};
 	io.exec("mkdir -p /etc/docker");
-	const configPath = "/etc/docker/daemon.json";
+	const configPath = DAEMON_CONFIG;
 	if (io.fileExists(configPath)) try {
 		const merged = {
 			...JSON.parse(io.readFile(configPath)),
@@ -369,7 +293,7 @@ function configureDocker(io = nodeIo) {
 		return;
 	}
 	else io.writeFile(configPath, JSON.stringify(daemonConfig, null, 2));
-	io.exec("systemctl reload docker || systemctl restart docker");
+	io.exec("systemctl restart docker");
 	success("Docker configured with production settings");
 }
 /**
@@ -437,15 +361,21 @@ function installAgent(io = nodeIo) {
 * Create the agent configuration
 */
 function createAgentConfig(options, io = nodeIo) {
-	const { tld, trustedProxyHops = 1 } = options;
+	const { tld, trustedProxyHops = 1, dnsProvider, dnsEnv = {} } = options;
 	step("Create agent configuration");
 	io.exec("mkdir -p /etc/trafic");
 	io.exec("mkdir -p /var/lib/trafic");
 	io.exec("chown ddev:ddev /var/lib/trafic");
 	const configPath = "/etc/trafic/config.toml";
+	const tlsSection = buildTlsSection(dnsProvider, dnsEnv);
 	if (io.fileExists(configPath)) {
 		info("Configuration already exists at /etc/trafic/config.toml — skipping");
 		info("Edit this file to configure authentication");
+		if (tlsSection) {
+			info("Add this to /etc/trafic/config.toml, then run `trafic-agent upgrade`:");
+			for (const line of buildTlsSection(dnsProvider, dnsEnv, true).trim().split("\n")) info(`  ${line}`);
+			info("Replace each REPLACE_ME with the value you passed to --dns-env.");
+		}
 		return;
 	}
 	const config = `# Trafic agent configuration
@@ -480,7 +410,7 @@ rules = []
 # Too low and allowed_ips matches a proxy instead of the client; too high and
 # it can be spoofed by a client-supplied header.
 trusted_proxy_hops = ${trustedProxyHops}
-`;
+${tlsSection}`;
 	io.writeFile(configPath, config);
 	io.exec("chmod 640 /etc/trafic/config.toml");
 	io.exec("chown root:ddev /etc/trafic/config.toml");
@@ -488,6 +418,31 @@ trusted_proxy_hops = ${trustedProxyHops}
 	info("Edit this file to configure authentication");
 }
 /**
+* Build the [tls] section of the generated config.
+*
+* Empty without a DNS provider: per-host certificates stay the default, and
+* an empty section would only invite a half-filled one.
+*/
+function buildTlsSection(dnsProvider, dnsEnv, redact = false) {
+	if (!dnsProvider) return "";
+	const env = Object.entries(dnsEnv).map(([key, value]) => `${key} = "${redact ? "REPLACE_ME" : escapeTomlString(value)}"`).join("\n");
+	return `
+# Wildcard certificate (DNS-01). One *.<tld> certificate replaces the
+# per-hostname ones, so previews stop consuming the Let's Encrypt quota.
+[tls]
+dns_provider = "${escapeTomlString(dnsProvider)}"
+# ca_server = "https://acme-staging-v02.api.letsencrypt.org/directory"
+
+# Credentials the lego provider reads. Passed to the ddev-router container.
+[tls.dns_env]
+${env}
+`;
+}
+/** Escape a value for a basic (double-quoted) TOML string. */
+function escapeTomlString(value) {
+	return value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t");
+}
+/**
 * Create systemd service for the agent
 */
 function createSystemdService(io = nodeIo) {
@@ -811,32 +766,21 @@ function hardenServer(options = {}, io = nodeIo) {
 //#endregion
 //#region src/setup/audit.ts
 /**
-* Run a command silently and return output
-*/
-function execSilent(command) {
-	try {
-		return execSync(command, {
-			encoding: "utf-8",
-			stdio: "pipe"
-		}).trim();
-	} catch {
-		return "";
-	}
-}
-/**
 * Check if a service is active
 */
-function isServiceActive(service) {
-	return execSilent(`systemctl is-active ${service}`) === "active";
+function isServiceActive(service, io) {
+	return io.execSilent(`systemctl is-active ${service}`) === "active";
+}
+/** Read a file, or "" when it does not exist. */
+function readOrEmpty(path, io) {
+	return io.fileExists(path) ? io.readFile(path) : "";
 }
 /**
 * Audit SSH configuration
 */
-function auditSsh() {
+function auditSsh(io = nodeIo) {
 	const checks = [];
-	const sshdConfig = existsSync("/etc/ssh/sshd_config") ? readFileSync("/etc/ssh/sshd_config", "utf-8") : "";
-	const traficConfig = existsSync("/etc/ssh/sshd_config.d/trafic.conf") ? readFileSync("/etc/ssh/sshd_config.d/trafic.conf", "utf-8") : "";
-	const config = sshdConfig + "\n" + traficConfig;
+	const config = readOrEmpty("/etc/ssh/sshd_config", io) + "\n" + readOrEmpty("/etc/ssh/sshd_config.d/trafic.conf", io);
 	const rootLoginDisabled = config.includes("PermitRootLogin no") || config.includes("PermitRootLogin prohibit-password");
 	checks.push({
 		name: "SSH root login",
@@ -856,9 +800,9 @@ function auditSsh() {
 /**
 * Audit firewall configuration
 */
-function auditFirewall() {
+function auditFirewall(io = nodeIo) {
 	const checks = [];
-	const ufwStatus = execSilent("ufw status");
+	const ufwStatus = io.execSilent("ufw status");
 	const isActive = ufwStatus.includes("Status: active");
 	checks.push({
 		name: "Firewall (UFW)",
@@ -887,23 +831,23 @@ function auditFirewall() {
 /**
 * Audit security services
 */
-function auditServices() {
+function auditServices(io = nodeIo) {
 	const checks = [];
-	const fail2banActive = isServiceActive("fail2ban");
+	const fail2banActive = isServiceActive("fail2ban", io);
 	checks.push({
 		name: "Fail2ban",
 		status: fail2banActive ? "pass" : "warn",
 		message: fail2banActive ? "Fail2ban is active" : "Fail2ban is not running",
 		fix: "Run: apt install fail2ban && systemctl enable fail2ban --now"
 	});
-	const unattendedActive = isServiceActive("unattended-upgrades");
+	const unattendedActive = isServiceActive("unattended-upgrades", io);
 	checks.push({
 		name: "Automatic updates",
 		status: unattendedActive ? "pass" : "warn",
 		message: unattendedActive ? "Unattended upgrades enabled" : "Automatic updates not configured",
 		fix: "Run: apt install unattended-upgrades && dpkg-reconfigure unattended-upgrades"
 	});
-	const agentActive = isServiceActive("trafic-agent");
+	const agentActive = isServiceActive("trafic-agent", io);
 	checks.push({
 		name: "Trafic agent",
 		status: agentActive ? "pass" : "fail",
@@ -915,16 +859,16 @@ function auditServices() {
 /**
 * Audit Docker
 */
-function auditDocker() {
+function auditDocker(io = nodeIo) {
 	const checks = [];
-	const dockerActive = isServiceActive("docker");
+	const dockerActive = isServiceActive("docker", io);
 	checks.push({
 		name: "Docker",
 		status: dockerActive ? "pass" : "fail",
 		message: dockerActive ? "Docker is running" : "Docker is not running",
 		fix: "Run: systemctl start docker"
 	});
-	const danglingImages = execSilent("docker images -f dangling=true -q | wc -l");
+	const danglingImages = io.execSilent("docker images -f dangling=true -q | wc -l");
 	const count = parseInt(danglingImages, 10) || 0;
 	if (count > 0) checks.push({
 		name: "Docker cleanup",
@@ -932,7 +876,7 @@ function auditDocker() {
 		message: `${count} dangling Docker images`,
 		fix: "Run: docker system prune -f"
 	});
-	const diskUsage = execSilent("df -h / | awk 'NR==2{print $5}'");
+	const diskUsage = io.execSilent("df -h / | awk 'NR==2{print $5}'");
 	const usagePercent = parseInt(diskUsage, 10) || 0;
 	checks.push({
 		name: "Disk usage",
@@ -945,10 +889,10 @@ function auditDocker() {
 /**
 * Audit file permissions
 */
-function auditPermissions() {
+function auditPermissions(io = nodeIo) {
 	const checks = [];
-	if (existsSync("/etc/trafic/config.toml")) {
-		const stats = execSilent("stat -c '%a' /etc/trafic/config.toml");
+	if (io.fileExists("/etc/trafic/config.toml")) {
+		const stats = io.execSilent("stat -c '%a' /etc/trafic/config.toml");
 		const isSecure = stats === "640" || stats === "600";
 		checks.push({
 			name: "Config permissions",
@@ -957,8 +901,8 @@ function auditPermissions() {
 			fix: "Run: chmod 640 /etc/trafic/config.toml"
 		});
 	}
-	if (existsSync("/home/ddev/www")) {
-		const owner = execSilent("stat -c '%U:%G' /home/ddev/www");
+	if (io.fileExists("/home/ddev/www")) {
+		const owner = io.execSilent("stat -c '%U:%G' /home/ddev/www");
 		const isCorrect = owner === "ddev:ddev";
 		checks.push({
 			name: "Projects directory",
@@ -970,15 +914,86 @@ function auditPermissions() {
 	return checks;
 }
 /**
+* Audit the wildcard certificate, where one is configured.
+*
+* Two things go wrong silently: the certificate is never issued (a wrong
+* token, a zone the token cannot edit), and the token file ends up readable
+* by everyone.
+*/
+function auditWildcardTls(config, io = nodeIo) {
+	if (!config.tls.dnsProvider) return [];
+	const checks = [];
+	checks.push(wildcardCertificateCheck(config.tld, io));
+	if (io.fileExists("/home/ddev/.ddev/router-compose.trafic.yaml")) {
+		const mode = io.execSilent(`stat -c '%a' ${ROUTER_COMPOSE_OVERRIDE}`);
+		const isSecure = mode === "600";
+		checks.push({
+			name: "DNS credentials permissions",
+			status: isSecure ? "pass" : "warn",
+			message: isSecure ? "Router compose override is readable by its owner only" : `Router compose override permissions: ${mode} (should be 600)`,
+			fix: `Run: chmod 600 ${ROUTER_COMPOSE_OVERRIDE}`
+		});
+	}
+	return checks;
+}
+/** Look for the wildcard certificate in Traefik's DNS-01 ACME storage. */
+function wildcardCertificateCheck(tld, io) {
+	const fix = "Check the router log for ACME errors: docker logs ddev-router 2>&1 | grep -i acme";
+	const mountpoint = io.execSilent("docker volume inspect ddev-global-cache --format '{{.Mountpoint}}'");
+	if (!mountpoint) return {
+		name: "Wildcard certificate",
+		status: "warn",
+		message: "Traefik's storage volume (ddev-global-cache) was not found",
+		fix
+	};
+	const storage = `${mountpoint}/traefik/acme-dns.json`;
+	if (!io.fileExists(storage)) return {
+		name: "Wildcard certificate",
+		status: "warn",
+		message: "No DNS-01 certificate has been issued yet",
+		fix
+	};
+	const issued = hasCertificateFor(io.readFile(storage), tld);
+	return {
+		name: "Wildcard certificate",
+		status: issued ? "pass" : "warn",
+		message: issued ? `Wildcard certificate issued for *.${tld}` : `No certificate for ${tld} in Traefik's DNS-01 storage`,
+		fix: issued ? void 0 : fix
+	};
+}
+/**
+* Whether Traefik's ACME storage holds a certificate whose main domain is the
+* TLD — which is the wildcard one, since that is what the default store asks
+* for.
+*
+* The file is keyed by resolver name, each with a Certificates array.
+*/
+function hasCertificateFor(storage, tld) {
+	let parsed;
+	try {
+		parsed = JSON.parse(storage);
+	} catch {
+		return false;
+	}
+	if (parsed === null || typeof parsed !== "object") return false;
+	for (const resolver of Object.values(parsed)) {
+		const certificates = resolver.Certificates;
+		if (!Array.isArray(certificates)) continue;
+		for (const certificate of certificates) if (certificate.domain?.main === tld) return true;
+	}
+	return false;
+}
+/**
 * Run all audit checks
 */
-function runAudit() {
+function runAudit(io = nodeIo, config = loadConfig()) {
 	return [
-		...auditSsh(),
-		...auditFirewall(),
-		...auditServices(),
-		...auditDocker(),
-		...auditPermissions()
+		...auditSsh(io),
+		...auditFirewall(io),
+		...auditServices(io),
+		...auditDocker(io),
+		...auditPermissions(io),
+		...auditWildcardTls(config, io)
 	];
 }
 /**
@@ -1157,7 +1172,7 @@ var migration0007UfwDockerTraficPort = {
 	id: "0007__ufw_docker_trafic_port",
 	description: "Allow trafic-agent port 9876 from Docker bridge subnets in UFW",
 	run() {
-		if (execSilent$1("ufw status | grep '9876'").includes("9876")) return;
+		if (execSilent("ufw status | grep '9876'").includes("9876")) return;
 		exec("ufw allow from 172.16.0.0/12 to any port 9876 comment 'trafic-agent from Docker'", { silent: true });
 	}
 };
@@ -1234,7 +1249,7 @@ http:
 //#endregion
 //#region src/setup/migrations/0009__scale_to_zero_fixes.ts
 var UNIT_PATH = "/etc/systemd/system/trafic-agent.service";
-var DYNAMIC_CONFIG$1 = "/home/ddev/.ddev/traefik/trafic.yaml";
+var DYNAMIC_CONFIG$2 = "/home/ddev/.ddev/traefik/trafic.yaml";
 /**
 * Migration 0009: Make scale-to-zero actually work.
 *
@@ -1261,7 +1276,7 @@ var migration0009ScaleToZeroFixes = {
 	description: "Fix scale-to-zero: waiting page router and agent write access",
 	run() {
 		const unitNeedsWrite = !existsSync(UNIT_PATH) || !/^ReadWritePaths=.*\/home\/ddev(\s|$)/m.test(readFileSync(UNIT_PATH, "utf-8"));
-		if (!existsSync(DYNAMIC_CONFIG$1) || !readFileSync(DYNAMIC_CONFIG$1, "utf-8").includes("trafic-catchall")) {
+		if (!existsSync(DYNAMIC_CONFIG$2) || !readFileSync(DYNAMIC_CONFIG$2, "utf-8").includes("trafic-catchall")) {
 			configureTraefik();
 			exec("su - ddev -c 'DDEV_NONINTERACTIVE=true ddev poweroff && ddev start --all'", { silent: true });
 		}
@@ -1270,7 +1285,7 @@ var migration0009ScaleToZeroFixes = {
 };
 //#endregion
 //#region src/setup/migrations/0010__catchall_entrypoints.ts
-var DYNAMIC_CONFIG = "/home/ddev/.ddev/traefik/custom-global-config/trafic.yaml";
+var DYNAMIC_CONFIG$1 = "/home/ddev/.ddev/traefik/custom-global-config/trafic.yaml";
 /** The copy setup used to write for DDEV versions that watched the root. */
 var STALE_CONFIG = "/home/ddev/.ddev/traefik/trafic.yaml";
 /**
@@ -1297,7 +1312,7 @@ var migration0010CatchallEntrypoints = {
 	id: "0010__catchall_entrypoints",
 	description: "Pin the Traefik catch-all routers to their entry points",
 	run() {
-		const pinned = existsSync(DYNAMIC_CONFIG) && readFileSync(DYNAMIC_CONFIG, "utf-8").includes("entryPoints:");
+		const pinned = existsSync(DYNAMIC_CONFIG$1) && readFileSync(DYNAMIC_CONFIG$1, "utf-8").includes("entryPoints:");
 		if (pinned && !existsSync(STALE_CONFIG)) return;
 		if (!pinned) configureTraefik();
 		if (existsSync(STALE_CONFIG)) exec(`rm -f ${STALE_CONFIG}`, { silent: true });
@@ -1332,10 +1347,10 @@ var migration0011PurgeAcmeWhenDisabled = {
 	id: "0011__purge_acme_when_disabled",
 	description: "Remove Traefik's Let's Encrypt storage when it is disabled",
 	run() {
-		const globalConfig = execSilent$1("su - ddev -c 'ddev config global'");
+		const globalConfig = execSilent("su - ddev -c 'ddev config global'");
 		if (!/^use-letsencrypt=false$/m.test(globalConfig)) return;
 		if (!purgeTraefikAcmeStorage()) return;
-		execSilent$1("docker restart ddev-router");
+		execSilent("docker restart ddev-router");
 	}
 };
 //#endregion
@@ -1436,6 +1451,178 @@ var migration0014UnattendedUpgradesDockerOrigin = {
 	}
 };
 //#endregion
+//#region src/setup/migrations/0015__catchall_priority.ts
+var DYNAMIC_CONFIG = "/home/ddev/.ddev/traefik/custom-global-config/trafic.yaml";
+/**
+* Migration 0015: raise the Trafic catch-all routers above DDEV's own.
+*
+* DDEV 1.25.4's router image adds two catch-all routers of its own in
+* `default_config.yaml` — `ddev-router-fallback-http` and
+* `ddev-router-fallback-https`, from the `traefik_global_config_template.yaml`
+* template in ddev/ddev. They carry the rule `PathPrefix(`/`)` at priority 1,
+* on every router entry point, and point at a socat responder that answers
+* 404. Trafic's own catch-all routers used priority 1 too.
+*
+* With equal priority and identical rules Traefik picked DDEV's, so a stopped
+* project answered DDEV's 404 page instead of the Trafic waiting page, and
+* scale-to-zero never restarted it — the waiting page is what triggers the
+* restart. Observed in the access log of a live server:
+* `"GET /rien-a-mettre.html HTTP/2.0" 404 ...
+* "http-443-ddev-router-fallback-https@file"`.
+*
+* `trafic-agent upgrade` installs DDEV 1.25.4, so every upgraded server is
+* affected. Priority 2 puts the Trafic routers back in front, and is still far
+* below any project router, so per-project routing and auth are unchanged.
+*
+* Traefik reads its config from the ddev-global-cache volume, and DDEV copies
+* `~/.ddev/traefik/custom-global-config/*.yaml` into it on any `ddev start` —
+* `PushGlobalTraefikConfig` runs even when the router is already up. Starting
+* one project that is already running is therefore enough to load the new
+* priority; `ddev poweroff` would stop every preview on the server for no
+* gain, so it is not used. When nothing runs, there is nothing to push to and
+* the next project start applies it.
+*
+* Unrelated and not addressed here: DDEV 1.25.4 also logs "Router count
+* mismatch" warnings, because its two fallback definitions attach to every
+* entry point while its health check counts definitions. That is DDEV's own
+* check against DDEV's own routers.
+*
+* Idempotent: skipped when the config is missing, and when no `priority: 1`
+* is left in it.
+*/
+var migration0015CatchallPriority = {
+	id: "0015__catchall_priority",
+	description: "Raise the Traefik catch-all routers above DDEV's fallback routers",
+	run() {
+		if (!existsSync(DYNAMIC_CONFIG)) return;
+		if (!readFileSync(DYNAMIC_CONFIG, "utf-8").includes("priority: 1")) return;
+		configureTraefik();
+		const project = findRunningProject();
+		if (!project) {
+			info("No project is running — the new priority applies on the next project start.");
+			return;
+		}
+		exec(`su - ddev -c 'DDEV_NONINTERACTIVE=true ddev start ${project}'`, { silent: true });
+	}
+};
+//#endregion
+//#region src/setup/migrations/0016__wildcard_dns_challenge.ts
+/**
+* Migration 0016: apply the wildcard DNS-01 certificate on servers that ask
+* for one in their config.
+*
+* `tls.dns_provider` is read by `configureTraefik`, which setup runs on a
+* fresh server. An existing server has the config but none of the files, so
+* this writes them: the resolver in `static_config.trafic.yaml`, the default
+* TLS store in `custom-global-config/0-trafic-tls.yaml`, and the provider
+* credentials in `router-compose.trafic.yaml`.
+*
+* Why the router is removed and a project started, rather than restarted
+* (the 0010 rationale, plus one more): Traefik reads its configuration from
+* the ddev-global-cache volume, and DDEV only copies `~/.ddev/traefik` into
+* that volume and merges `static_config.*.yaml` into `.static_config.yaml`
+* when a project starts. And DDEV 1.25 reads `router-compose.*.yaml` only
+* when it *recreates* the router: a running, healthy router just gets the
+* Traefik config pushed (StartDdevRouter, `needsRecreation`). Seen on a live
+* server — the static config was merged, the credentials never reached the
+* container. Removing the router first forces the recreation; `ddev start`
+* brings it back within seconds with the new environment.
+*
+* The container is found by its compose label, not by name: when compose
+* recreates a container it renames the old one `<id>_ddev-router`, and a
+* failed recreation can leave it that way. `docker restart ddev-router` then
+* silently does nothing — also seen on that server.
+*
+* Two details this depends on:
+* - Traefik's file provider keeps the FIRST `tls.stores.default` it reads in
+*   directory order and logs "TLS store default already configured,
+*   skipping" for the rest. DDEV writes an empty one in
+*   `default_config.yaml`, so the agent's file is named `0-trafic-tls.yaml`
+*   to sort ahead of it.
+* - DDEV keeps `certResolver: acme-tlsChallenge` on every project router, and
+*   that is fine: Traefik skips a per-host ACME request once the default
+*   store already holds a certificate matching the host with wildcard
+*   semantics. So `use_letsencrypt` stays true — the ACME account email comes
+*   from it — and the per-host quota use stops on its own.
+*
+* `ddev poweroff` is deliberately not used: the server runs live previews and
+* a project start is enough to regenerate the config and recreate the router.
+*
+* Idempotent: skipped when no DNS provider is configured, and when all three
+* files are already in place.
+*/
+var migration0016WildcardDnsChallenge = {
+	id: "0016__wildcard_dns_challenge",
+	description: "Apply the wildcard DNS-01 certificate where one is configured",
+	run() {
+		runWildcardMigration();
+	}
+};
+/**
+* The migration body, with its effects injected so tests can drive it.
+*
+* `tls` defaults to the server's own config: the migration runs after setup
+* wrote /etc/trafic/config.toml, so that file is the only source.
+*/
+function runWildcardMigration(io = nodeIo, tls = loadConfig().tls) {
+	if (!tls.dnsProvider) return;
+	if (io.fileExists(STATIC_CONFIG) && io.readFile(STATIC_CONFIG).includes(`acme-dns:`) && io.fileExists(TLS_STORE_CONFIG) && io.fileExists("/home/ddev/.ddev/router-compose.trafic.yaml")) return;
+	configureTraefik({ tls }, io);
+	const project = findRunningProject(io);
+	if (!project) {
+		info("No running project — the next deploy applies the wildcard certificate");
+		return;
+	}
+	const router = findRouterContainer(io);
+	if (router) io.execSilent(`docker rm -f ${router}`);
+	io.exec(`su - ddev -c 'DDEV_NONINTERACTIVE=true ddev start ${project}'`, { silent: true });
+}
+/**
+* The ddev-router container id, whatever its current name.
+*
+* Compose labels survive the `<id>_ddev-router` rename a recreation leaves
+* behind; the container name does not.
+*/
+function findRouterContainer(io = nodeIo) {
+	return io.execSilent("docker ps -aq --filter label=com.docker.compose.service=ddev-router").trim().split("\n")[0] || void 0;
+}
+//#endregion
+//#region src/setup/migrations/0018__docker_address_pools.ts
+/**
+* Migration 0018: give Docker enough address space for one network per
+* project.
+*
+* `setup` wrote a daemon.json without `default-address-pools`, so Docker
+* used its built-in pools: about 31 networks. Each DDEV project creates its
+* own `ddev-<name>_default` network, and a server with ~30 projects failed
+* to start the next one with "all predefined address pools have been fully
+* subnetted". The last 16 of those built-in networks are in 192.168.x,
+* outside the 172.16.0.0/12 range the firewall allows to reach the agent.
+*
+* `configureDocker` now writes /24 pools in 172.16.0.0/12, which covers
+* fresh installs. This migration adds them to existing servers.
+*
+* Docker reads the pools only at start, so the daemon is restarted.
+* `live-restore`, set by setup, keeps the running containers up. Existing
+* networks keep their subnets; only new networks get a /24, and Docker skips
+* subnets an existing network already uses.
+*
+* Idempotent: does nothing when the config already sets pools.
+*/
+var migration0018DockerAddressPools = {
+	id: "0018__docker_address_pools",
+	description: "Give Docker address pools for one network per project",
+	run() {
+		runDockerAddressPoolsMigration();
+	}
+};
+/**
+* The migration body, with its effects injected so tests can drive it.
+*/
+function runDockerAddressPoolsMigration(io = nodeIo) {
+	if (addDockerAddressPools(io)) io.exec("systemctl restart docker");
+}
+//#endregion
 //#region src/setup/migrations/index.ts
 /** Path to the persisted migration state file */
 var MIGRATIONS_STATE_FILE = "/etc/trafic/.migrations.json";
@@ -1454,7 +1641,10 @@ var ALL_MIGRATIONS = [
 	migration0011PurgeAcmeWhenDisabled,
 	migration0012DockerUserToolPorts,
 	migration0013SshKexDefaults,
-	migration0014UnattendedUpgradesDockerOrigin
+	migration0014UnattendedUpgradesDockerOrigin,
+	migration0015CatchallPriority,
+	migration0016WildcardDnsChallenge,
+	migration0018DockerAddressPools
 ];
 /**
 * Load the current migration state from disk.
@@ -1541,6 +1731,7 @@ async function setup(options) {
 	}
 	info(`TLD: ${options.tld}`);
 	if (options.email) info(`Let's Encrypt email: ${options.email}`);
+	if (options.dnsProvider) info(`Wildcard certificate: DNS-01 via ${options.dnsProvider}`);
 	if (options.noHardening) info("Hardening: disabled");
 	if (options.noRootSsh) info("Root SSH login: disabled");
 	try {
@@ -1557,7 +1748,14 @@ async function setup(options) {
 		if (!options.noDdev) {
 			installDdev();
 			configureDdev(options.tld, options.email);
-			configureTraefik();
+			configureTraefik({
+				tld: options.tld,
+				tls: {
+					dnsProvider: options.dnsProvider,
+					caServer: options.caServer,
+					dnsEnv: options.dnsEnv ?? {}
+				}
+			});
 			configureDockerFirewall(readToolPorts());
 		} else {
 			step("Install DDEV");
@@ -1567,7 +1765,9 @@ async function setup(options) {
 		installAgent();
 		createAgentConfig({
 			tld: options.tld,
-			trustedProxyHops: options.trustedProxyHops
+			trustedProxyHops: options.trustedProxyHops,
+			dnsProvider: options.dnsProvider,
+			dnsEnv: options.dnsEnv
 		});
 		createSystemdService();
 		if (!options.noHardening) hardenServer({
@@ -1600,6 +1800,6 @@ async function audit() {
 	if (checks.filter((c) => c.status === "fail").length > 0) process.exit(1);
 }
 //#endregion
-export { printAuditResults as a, stopIdleProjects as c, buildDockerFirewallScript as d, buildDockerFirewallUnit as f, validateConfig as g, parseDuration as h, runPendingMigrations as i, DOCKER_FIREWALL_SCRIPT as l, loadConfig as m, setup as n, runAudit as o, configureDockerFirewall as p, listMigrations as r, startIdleScheduler as s, audit as t, DOCKER_FIREWALL_UNIT as u };
+export { printAuditResults as a, stopIdleProjects as c, buildDockerFirewallScript as d, buildDockerFirewallUnit as f, runPendingMigrations as i, DOCKER_FIREWALL_SCRIPT as l, setup as n, runAudit as o, configureDockerFirewall as p, listMigrations as r, startIdleScheduler as s, audit as t, DOCKER_FIREWALL_UNIT as u };
 
-//# sourceMappingURL=setup-BrMbM8w4.js.map
+//# sourceMappingURL=setup-4zlNJqDe.js.map