@studiometa/trafic-agent 0.1.49 → 0.1.51

package/dist/{setup-DWgb6dAD.js → setup-CiWIirVb.js}

@@ -1,5 +1,8 @@
-import { $ as stopProject, A as getIdleProjects, B as info, C as getIdleTimeoutMs, G as success, H as resetSteps, I as nodeIo, K as warn, L as error, P as setProjectStatus, R as exec, S as readToolPorts, T as shouldNeverStop, U as setDryRun, V as isRoot, W as step, Y as getProjectInfo, Z as loadProjectList, _ as findRunningProjects, b as installSystemDeps, d as STATIC_CONFIG, f as TLS_STORE_CONFIG, g as findRunningProject, h as configureTraefik, m as configureDdev, ot as loadConfig, p as addDdevAptRepo, st as parseDuration, u as ROUTER_COMPOSE_OVERRIDE, v as getDockerGatewayIp, w as loadProjectConfig, x as purgeTraefikAcmeStorage, y as installDdev, z as execSilent } from "./server-DZAo8Clg.js";
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { $ as exec, A as shouldNeverStop, B as getScheduledDestroy, C as installSystemDeps, Ct as parseDuration, D as enforceRunningLimit, E as ddevRunningLimitDeps, Et as isInside, F as deleteUnlistedProjects, G as releaseStaleStatuses, H as initDb, J as startScheduledDestroy, K as scheduleDestroy, M as cleanOldLogs, O as getIdleTimeoutMs, P as deleteProject, Q as error, R as getIdleProjects, S as installDdev, St as loadConfig, T as readToolPorts, V as getScheduledDestroys, Y as systemClock, Z as nodeIo, _ as configureDdev, at as step, b as findRunningProjects, et as execSilent, ft as loadProjectList, g as addDdevAptRepo, h as TLS_STORE_CONFIG, ht as stopProject, it as setDryRun, k as loadProjectConfig, m as STATIC_CONFIG, mt as startProject, nt as isRoot, ot as success, p as ROUTER_COMPOSE_OVERRIDE, pt as nodeDdevRunner, q as setProjectStatus, rt as resetSteps, st as warn, tt as info, ut as getProjectInfo, v as configureTraefik, w as purgeTraefikAcmeStorage, x as getDockerGatewayIp, y as findRunningProject, z as getProject } from "./server-Cfk-O4DJ.js";
+import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, rmdirSync, statSync, writeFileSync } from "node:fs";
+import { basename, dirname, join, posix, resolve } from "node:path";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
 //#region src/setup/docker-firewall.ts
 /** Where the rule script lives, so systemd and a human can both run it. */
 var DOCKER_FIREWALL_SCRIPT = "/usr/local/sbin/trafic-docker-firewall";
@@ -127,49 +130,816 @@ function configureDockerFirewall(toolPorts, io = nodeIo) {
 //#region src/tasks/stop-idle.ts
 /**
 * Stop idle projects that haven't been accessed recently
-* Respects per-project idle_timeout settings from .ddev/config.trafic.yaml
+* A project's idle_timeout in .ddev/config.trafic.yaml replaces the global
+* one, shorter or longer
+*
+* Only projects with the status "running" are idle: a project the agent is
+* starting or removing is never stopped here. A start or a removal whose
+* process was killed is set back to "running" first, so its project is not
+* left up for good. Before that, the records of projects that DDEV no longer
+* lists are deleted, so the sweep does not ask DDEV about them.
+*
+* Then brings the server back under max_running_projects: a deploy runs
+* `ddev start` without asking the agent, so only the sweep sees it.
 */
-async function stopIdleProjects(config) {
+async function stopIdleProjects(config, run = nodeDdevRunner) {
 	const globalThresholdMs = parseDuration(config.idleTimeout);
 	const projects = loadProjectList(config.projectListPath);
-	const idleProjects = getIdleProjects(globalThresholdMs);
-	for (const project of idleProjects) {
+	for (const name of deleteUnlistedProjects(new Set(projects.keys()))) console.log(`Removed ${name} from the agent database: DDEV no longer lists it`);
+	for (const name of releaseStaleStatuses()) console.log(`Set ${name} back to running: the process that started or removed it is gone`);
+	for (const project of getIdleProjects(0)) {
 		const projectDir = projects.get(project.name);
-		if (projectDir) {
-			const projectConfig = loadProjectConfig(projectDir);
-			if (shouldNeverStop(projectConfig)) continue;
-			const projectThresholdMs = getIdleTimeoutMs(projectConfig);
-			if (projectThresholdMs !== void 0) {
-				if (Date.now() - project.lastAccess < projectThresholdMs) continue;
-			}
-		}
-		if ((await getProjectInfo(project.name))?.status !== "running") {
+		const projectConfig = projectDir ? loadProjectConfig(projectDir) : {};
+		if (shouldNeverStop(projectConfig)) continue;
+		const thresholdMs = getIdleTimeoutMs(projectConfig) ?? globalThresholdMs;
+		if (Date.now() - project.lastAccess < thresholdMs) continue;
+		if ((await getProjectInfo(project.name, run))?.status !== "running") {
 			setProjectStatus(project.name, "stopped");
 			continue;
 		}
 		console.log(`Stopping idle project: ${project.name}`);
-		if (await stopProject(project.name)) {
+		if (await stopProject(project.name, run)) {
 			setProjectStatus(project.name, "stopped");
 			console.log(`Stopped: ${project.name}`);
 		} else console.error(`Failed to stop: ${project.name}`);
 	}
+	await enforceRunningLimit({
+		max: config.maxRunningProjects,
+		neverStops: (name) => {
+			const projectDir = projects.get(name);
+			return projectDir ? shouldNeverStop(loadProjectConfig(projectDir)) : false;
+		}
+	}, ddevRunningLimitDeps(run));
 }
 /**
 * Start the idle check scheduler
 */
 /** An idle sweep that throws must not take the scheduler down with it. */
-function reportSweepError(error) {
+function reportSweepError$1(error) {
 	console.error("Idle sweep failed:", error);
 }
 function startIdleScheduler(config) {
 	const intervalMs = parseDuration(config.idleCheckInterval);
 	console.log(`Idle scheduler started: checking every ${config.idleCheckInterval}, timeout ${config.idleTimeout}`);
-	stopIdleProjects(config).catch(reportSweepError);
+	stopIdleProjects(config).catch(reportSweepError$1);
 	return setInterval(() => {
-		stopIdleProjects(config).catch(reportSweepError);
+		stopIdleProjects(config).catch(reportSweepError$1);
 	}, intervalMs);
 }
 //#endregion
+//#region src/setup/agent.ts
+/** Node.js major version required by the agent */
+var NODE_MAJOR = 24;
+/** NodeSource keyring path */
+var NODESOURCE_KEYRING = "/etc/apt/keyrings/nodesource.gpg";
+/**
+* Add the NodeSource apt repository and GPG key.
+* Idempotent: safe to call even if the repository is already configured.
+*
+* nodejs.org points at NodeSource for apt installs. The Ubuntu 24.04
+* `nodejs` package is 18.x, far below what the agent needs.
+*/
+function addNodeSourceAptRepo(io = nodeIo) {
+	io.exec("install -m 0755 -d /etc/apt/keyrings", { silent: true });
+	io.exec("curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key -o /tmp/trafic-nodesource.key", { silent: true });
+	io.exec("gpg --batch --yes --dearmor -o /tmp/trafic-nodesource.gpg /tmp/trafic-nodesource.key", { silent: true });
+	io.exec(`install -m 0644 /tmp/trafic-nodesource.gpg ${NODESOURCE_KEYRING}`, { silent: true });
+	io.exec("rm -f /tmp/trafic-nodesource.key /tmp/trafic-nodesource.gpg", { silent: true });
+	io.exec(`echo "deb [signed-by=${NODESOURCE_KEYRING}] https://deb.nodesource.com/node_${NODE_MAJOR}.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list > /dev/null`, { silent: true });
+}
+/**
+* Install Node.js from the NodeSource apt repository.
+*
+* apt keeps node and npm in /usr/bin — on root's PATH, so `which
+* trafic-agent` resolves for the systemd unit — and unattended-upgrades
+* patches them, which a version manager install never gets.
+*/
+function installNode(io = nodeIo) {
+	step("Install Node.js");
+	if (io.commandExists("node")) {
+		const version = io.exec("node --version", { silent: true });
+		info(`Node.js already installed: ${version?.trim()}`);
+		return;
+	}
+	info("Adding NodeSource apt repository...");
+	addNodeSourceAptRepo(io);
+	info("Installing Node.js...");
+	io.exec("apt-get update -qq", { silent: true });
+	io.exec("DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y nodejs", { silent: true });
+	success(`Node.js ${NODE_MAJOR} installed from apt`);
+}
+/**
+* Install the Trafic agent globally, at the version that runs this setup.
+*
+* `trafic setup --agent-version` installs that version, then runs this
+* setup: an install with no version would replace it by the latest one.
+*/
+function installAgent(io = nodeIo) {
+	step("Install Trafic agent");
+	io.exec(`npm install -g @studiometa/trafic-agent@0.1.51`);
+	success(`Trafic agent 0.1.51 installed`);
+}
+/**
+* Create the agent configuration
+*/
+function createAgentConfig(options, io = nodeIo) {
+	const { tld, trustedProxyHops = 1, dnsProvider, dnsEnv = {} } = options;
+	step("Create agent configuration");
+	io.exec("mkdir -p /etc/trafic");
+	io.exec("mkdir -p /var/lib/trafic");
+	io.exec("chown ddev:ddev /var/lib/trafic");
+	createBackupDir$1(io);
+	const configPath = "/etc/trafic/config.toml";
+	const tlsSection = buildTlsSection(dnsProvider, dnsEnv);
+	if (io.fileExists(configPath)) {
+		info("Configuration already exists at /etc/trafic/config.toml — skipping");
+		info("Edit this file to configure authentication");
+		if (tlsSection) {
+			info("Add this to /etc/trafic/config.toml, then run `trafic-agent upgrade`:");
+			for (const line of buildTlsSection(dnsProvider, dnsEnv, true).trim().split("\n")) info(`  ${line}`);
+			info("Replace each REPLACE_ME with the value you passed to --dns-env.");
+		}
+		return;
+	}
+	const config = `# Trafic agent configuration
+# Generated by trafic setup
+
+# Required: TLD for DDEV projects
+tld = "${tld}"
+
+# Agent HTTP server port
+port = 9876
+
+# Database and paths
+db_path = "/var/lib/trafic/db.sqlite"
+project_list_path = "/home/ddev/.ddev/project_list.yaml"
+projects_dir = "/home/ddev/www"
+
+# Scale-to-zero settings
+idle_timeout = "4h"
+idle_check_interval = "5m"
+
+# Authentication
+[auth]
+default_policy = "basic"
+allowed_ips = []
+tokens = []
+basic_auth = []
+rules = []
+
+# Proxies in front of the agent, counted so the client address can be read
+# from X-Forwarded-For. 1 is ddev-router/Traefik alone. Raise it by one for
+# every extra proxy — a CDN or load balancer ahead of Traefik makes it 2.
+# Too low and allowed_ips matches a proxy instead of the client; too high and
+# it can be spoofed by a client-supplied header.
+trusted_proxy_hops = ${trustedProxyHops}
+${tlsSection}`;
+	io.writeFile(configPath, config);
+	io.exec("chmod 640 /etc/trafic/config.toml");
+	io.exec("chown root:ddev /etc/trafic/config.toml");
+	success("Configuration created at /etc/trafic/config.toml");
+	info("Edit this file to configure authentication");
+}
+/**
+* Build the [tls] section of the generated config.
+*
+* Empty without a DNS provider: per-host certificates stay the default, and
+* an empty section would only invite a half-filled one.
+*/
+function buildTlsSection(dnsProvider, dnsEnv, redact = false) {
+	if (!dnsProvider) return "";
+	const env = Object.entries(dnsEnv).map(([key, value]) => `${key} = "${redact ? "REPLACE_ME" : escapeTomlString(value)}"`).join("\n");
+	return `
+# Wildcard certificate (DNS-01). One *.<tld> certificate replaces the
+# per-hostname ones, so previews stop consuming the Let's Encrypt quota.
+[tls]
+dns_provider = "${escapeTomlString(dnsProvider)}"
+# ca_server = "https://acme-staging-v02.api.letsencrypt.org/directory"
+
+# Credentials the lego provider reads. Passed to the ddev-router container.
+[tls.dns_env]
+${env}
+`;
+}
+/** Escape a value for a basic (double-quoted) TOML string. */
+function escapeTomlString(value) {
+	return value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t");
+}
+/** Default backup directory, `[backup] dir` in the agent config. */
+var BACKUP_DIR = "/var/backups/trafic";
+/**
+* Create the backup directory, writable by the ddev user only: it holds
+* database dumps.
+*/
+function createBackupDir$1(io = nodeIo) {
+	io.exec(`mkdir -p ${BACKUP_DIR}`);
+	io.exec(`chown ddev:ddev ${BACKUP_DIR}`);
+	io.exec(`chmod 700 ${BACKUP_DIR}`);
+}
+/**
+* Create systemd service for the agent
+*/
+function createSystemdService(io = nodeIo) {
+	step("Create systemd service");
+	const serviceContent = `[Unit]
+Description=Trafic Agent - DDEV preview environment manager
+After=network.target docker.service
+Requires=docker.service
+
+[Service]
+Type=simple
+User=ddev
+Group=ddev
+ExecStart=${io.exec("which trafic-agent", { silent: true })?.trim() || "/usr/bin/trafic-agent"} start --config /etc/trafic/config.toml
+Restart=always
+RestartSec=5
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=trafic-agent
+
+# Environment
+Environment=NODE_ENV=production
+# Skip ddev-hostname /etc/hosts management — on a server, hostnames resolve
+# to the public IP (not localhost), which would trigger ddev-hostname on every
+# ddev start. DDEV_NONINTERACTIVE=true skips that entirely.
+Environment=DDEV_NONINTERACTIVE=true
+
+# Security hardening
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=read-only
+# ddev start writes across its own home: the project directory
+# (.ddev/.webimageBuild), buildx state in .docker, mutagen data. Listing
+# individual paths is whack-a-mole across DDEV versions, so grant the home
+# and leave the rest of /home read-only. The backup sweep removes old
+# backups from ${BACKUP_DIR}; with "-", a missing backup directory does not
+# stop the service from starting.
+ReadWritePaths=/var/lib/trafic /home/ddev -${BACKUP_DIR}
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target
+`;
+	io.writeFile("/etc/systemd/system/trafic-agent.service", serviceContent);
+	io.exec("chmod 644 /etc/systemd/system/trafic-agent.service");
+	io.exec("systemctl daemon-reload");
+	io.exec("systemctl enable trafic-agent");
+	io.exec("systemctl start trafic-agent");
+	success("Trafic agent service started");
+	info("View logs: journalctl -u trafic-agent -f");
+}
+//#endregion
+//#region src/tasks/backup.ts
+var execFileAsync = promisify(execFile);
+/** Where DDEV mounts the project in the web container. */
+var CONTAINER_APPROOT = "/var/www/html";
+/** Reading the upload directories is quick. */
+var UPLOAD_DIRS_TIMEOUT_MS = 6e4;
+/** Retention is counted in days, so an hourly sweep is enough. */
+var SWEEP_INTERVAL_MS$1 = 36e5;
+var DAY_MS = 864e5;
+/** A backup directory name: an ISO date in UTC, with `-` for `:`. */
+var TIMESTAMP = /^(\d{4}-\d{2}-\d{2})T(\d{2})-(\d{2})-(\d{2})Z$/;
+/** The name of a backup directory, e.g. `2026-10-14T07-40-24Z`. */
+function backupTimestamp(date) {
+	return `${date.toISOString().slice(0, 19).replace(/:/g, "-")}Z`;
+}
+/** The time of a backup directory name, or undefined for any other name. */
+function parseBackupTimestamp(name) {
+	const match = TIMESTAMP.exec(name);
+	if (!match) return;
+	const [, day, hours, minutes, seconds] = match;
+	const time = Date.parse(`${day}T${hours}:${minutes}:${seconds}Z`);
+	return Number.isNaN(time) ? void 0 : time;
+}
+/** Whether a path is an existing directory. */
+function isDirectory$1(path) {
+	try {
+		return statSync(path).isDirectory();
+	} catch {
+		return false;
+	}
+}
+/**
+* The upload directories of a project, relative to its directory.
+*
+* DDEV resolves them: `upload_dirs` from the project config, or the default
+* of the project type (`wp-content/uploads` for WordPress, for instance).
+* Neither `ddev describe` nor `ddev utility configyaml` shows the type
+* default, but DDEV gives the result to the web container as
+* `DDEV_FILES_DIRS`, comma-separated container paths. The project must be
+* running.
+*
+* A directory that does not exist on the host is left out.
+*/
+async function findUploadDirs(dir, timeoutMs, run) {
+	const { ok, stdout } = await run([
+		"exec",
+		"printenv",
+		"DDEV_FILES_DIRS"
+	], timeoutMs, dir);
+	if (!ok) throw new Error("Could not read the upload directories (DDEV_FILES_DIRS)");
+	return stdout.trim().split(",").filter(Boolean).map((path) => posix.relative(CONTAINER_APPROOT, path)).filter((path) => path && !path.startsWith("..") && !posix.isAbsolute(path)).filter((path) => isDirectory$1(join(dir, path)));
+}
+/**
+* Create the backup directory of one backup (see createBackupDir).
+*
+* The agent service runs in a systemd sandbox (`ProtectSystem=strict`) that
+* can write to a few paths only. A `[backup] dir` outside of them is
+* read-only for the service, so every scheduled backup fails and the
+* project is never removed: say so in the error, which the sweep logs.
+*/
+function createBackupTarget(target, backupDir, name) {
+	try {
+		mkdirSync(join(backupDir, name), { recursive: true });
+		createBackupDir(target, name);
+	} catch (error) {
+		const { code } = error;
+		if (code !== "EROFS" && code !== "EACCES") throw error;
+		throw new Error(`Cannot write to the backup directory ${backupDir} (${code}). The agent service runs in a systemd sandbox (ProtectSystem=strict) and can only write to /var/lib/trafic, /home/ddev and ${BACKUP_DIR}: set [backup] dir inside one of them, writable by the ddev user`, { cause: error });
+	}
+}
+/** The time left before the deadline of the backup. */
+function timeLeft(deadline) {
+	const left = deadline - Date.now();
+	if (left <= 0) throw new Error("No time is left for the next step");
+	return left;
+}
+/** A duration in the largest whole unit: 1h, 40m or 90s. */
+function formatDuration(ms) {
+	if (ms % 36e5 === 0) return `${ms / 36e5}h`;
+	if (ms % 6e4 === 0) return `${ms / 6e4}m`;
+	return `${Math.ceil(ms / 1e3)}s`;
+}
+/**
+* The error of a backup that went over its time limit. The step that ran
+* out of time only fails (ddev reports a failed command, tar is killed), so
+* this says it was the time limit, and how to raise it.
+*/
+function timeoutError(timeoutMs, cause) {
+	return new Error(`The backup timed out: it took longer than its time limit of ${formatDuration(timeoutMs)}. Raise the limit with --timeout`, { cause });
+}
+/**
+* Write the database dump and the upload archive of a running project.
+* Each step gets the time left before `deadline`.
+*/
+async function writeBackup(hasDatabase, dir, target, deadline, run) {
+	if (hasDatabase) {
+		const file = join(target, "db.sql.gz");
+		console.log(`Exporting the database to ${file}`);
+		const { ok } = await run(["export-db", `--file=${file}`], timeLeft(deadline), dir);
+		if (!ok) throw new Error("Could not export the database");
+	} else console.log("No database container — skipping the database dump");
+	const uploadDirs = await findUploadDirs(dir, Math.min(UPLOAD_DIRS_TIMEOUT_MS, timeLeft(deadline)), run);
+	if (uploadDirs.length === 0) {
+		console.log("No upload directory — skipping the files archive");
+		return;
+	}
+	const file = join(target, "files.tar.gz");
+	console.log(`Archiving ${uploadDirs.join(", ")} to ${file}`);
+	await archive(file, dir, uploadDirs, timeLeft(deadline));
+}
+/**
+* Archive paths of a directory to a tar.gz file.
+*
+* The project runs during the archive, and can write to its upload
+* directories at any time. GNU tar then exits with code 1 ("some files
+* differ"): the archive is written, with the changed file as tar read it.
+* That is accepted with a warning. Code 2 or more (a fatal error, such as an
+* unreadable file) and a timeout fail the archive.
+*/
+async function archive(file, dir, paths, timeoutMs) {
+	try {
+		await execFileAsync("tar", [
+			"-czf",
+			file,
+			"-C",
+			dir,
+			"--",
+			...paths
+		], { timeout: timeoutMs });
+	} catch (error) {
+		const { code, killed } = error;
+		if (code !== 1 || killed) throw error;
+		console.warn("Some files changed while tar read them: the archive has them as tar read them");
+	}
+}
+/**
+* Create the directory of one backup. It must not exist: two backups of a
+* project in the same second would share it, and the one that fails would
+* remove the files of the other. The second one fails here, before it
+* changes anything.
+*/
+function createBackupDir(target, name) {
+	try {
+		mkdirSync(target);
+	} catch (error) {
+		if (error.code === "EEXIST") throw new Error(`${target} already exists: another backup of ${name} runs or ran in the same second`);
+		throw error;
+	}
+}
+/**
+* Back up a DDEV project to `<backupDir>/<name>/<timestamp>`.
+*
+* The backup holds:
+* - `db.sql.gz`: the `ddev export-db` dump, unless the project omits the db
+*   container
+* - `files.tar.gz`: the upload directories, with paths relative to the
+*   project directory, unless the project has none
+*
+* Both need the project running, so a stopped project is started, then
+* stopped again. A failed backup, or a backup that takes longer than its
+* time limit (`timeoutMs`), throws and leaves no backup directory. Returns
+* the backup directory.
+*/
+async function backupProject(name, dir, backupDir, options = {}, run = nodeDdevRunner) {
+	const info = await getProjectInfo(name, run);
+	if (!info) throw new Error(`Could not describe the DDEV project ${name}`);
+	const target = join(backupDir, name, backupTimestamp(/* @__PURE__ */ new Date()));
+	const wasRunning = info.status === "running";
+	createBackupTarget(target, backupDir, name);
+	try {
+		if (!wasRunning) {
+			console.log(`Starting ${name} for the backup`);
+			if (!await startProject(name, run)) throw new Error(`Could not start ${name} for the backup`);
+		}
+		const timeoutMs = options.timeoutMs ?? 24e5;
+		const deadline = Date.now() + timeoutMs;
+		try {
+			await writeBackup(info.dbType !== void 0, dir, target, deadline, run);
+		} catch (error) {
+			throw Date.now() >= deadline ? timeoutError(timeoutMs, error) : error;
+		} finally {
+			if (!wasRunning && !await stopProject(name, run)) console.warn(`Could not stop ${name} after the backup`);
+		}
+	} catch (error) {
+		rmSync(target, {
+			recursive: true,
+			force: true
+		});
+		throw error;
+	}
+	console.log(`Backup saved to ${target}`);
+	return target;
+}
+/** The subdirectories of a directory, or none when it does not exist. */
+function listDirs(path) {
+	if (!existsSync(path)) return [];
+	return readdirSync(path, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+}
+/**
+* Remove the backups older than `retainDays`, and the project directories
+* that this removal leaves empty. Only directories with a backup timestamp
+* name are removed, and a project directory only when this sweep removed a
+* backup from it: `dir` can be a shared directory, with empty directories
+* that are not backups. Returns the number of backups removed.
+*/
+function removeOldBackups(config, now = Date.now()) {
+	const cutoff = now - config.retainDays * DAY_MS;
+	let removed = 0;
+	for (const project of listDirs(config.dir)) {
+		const projectDir = join(config.dir, project);
+		let removedFromProject = 0;
+		for (const name of listDirs(projectDir)) {
+			const time = parseBackupTimestamp(name);
+			if (time !== void 0 && time < cutoff) {
+				rmSync(join(projectDir, name), {
+					recursive: true,
+					force: true
+				});
+				console.log(`Removed old backup: ${project}/${name}`);
+				removedFromProject++;
+			}
+		}
+		removed += removedFromProject;
+		if (removedFromProject === 0) continue;
+		try {
+			if (readdirSync(projectDir).length === 0) rmdirSync(projectDir);
+		} catch {}
+	}
+	return removed;
+}
+/** A sweep that throws must not take the scheduler down with it. */
+function sweepBackups(config) {
+	try {
+		removeOldBackups(config);
+	} catch (error) {
+		console.error("Backup sweep failed:", error);
+	}
+}
+/**
+* Start the backup retention sweep
+*/
+function startBackupSweepScheduler(config) {
+	console.log(`Backup sweep started: removing backups older than ${config.backup.retainDays} days from ${config.backup.dir}`);
+	sweepBackups(config.backup);
+	return setInterval(() => sweepBackups(config.backup), SWEEP_INTERVAL_MS$1);
+}
+//#endregion
+//#region src/tasks/destroy-project.ts
+/** Removing containers and volumes is slower than a stop. */
+var DELETE_TIMEOUT_MS = 3e5;
+/**
+* What to do when `trafic-agent destroy` cannot read the config or open the
+* database. Only the ddev user can do both: the config is readable by root
+* and the ddev group only (640 root:ddev), and the database directory
+* belongs to ddev. `trafic destroy` connects as ddev by default.
+*/
+var DDEV_USER_HINT = "connect as the ddev user";
+/** SQLite result codes of a database that the user cannot open or write. */
+var SQLITE_ACCESS_ERRORS = /* @__PURE__ */ new Set([
+	3,
+	8,
+	14
+]);
+/**
+* Read the agent config for `trafic-agent destroy`. A permission error says
+* which user to connect as.
+*/
+function loadDestroyConfig(configPath) {
+	try {
+		return loadConfig(configPath);
+	} catch (error) {
+		const { code, path } = error;
+		if (code !== "EACCES" && code !== "EPERM") throw error;
+		throw new Error(`cannot read ${path ?? configPath} (${code}): ${DDEV_USER_HINT}`, { cause: error });
+	}
+}
+/**
+* Open the agent database for `trafic-agent destroy`. A permission error
+* says which user to connect as.
+*/
+function openDestroyDb(dbPath) {
+	try {
+		initDb(dbPath);
+	} catch (error) {
+		const { errcode } = error;
+		if (errcode === void 0 || !SQLITE_ACCESS_ERRORS.has(errcode & 255)) throw error;
+		throw new Error(`cannot open the database ${dbPath} (${error.message}): ${DDEV_USER_HINT}`, { cause: error });
+	}
+}
+/**
+* Find the directory of a project, and refuse one outside the projects
+* directory.
+*
+* DDEV's project list gives the real app root. A project DDEV has already
+* forgotten is looked for at `<projects_dir>/<name>`, where `trafic deploy`
+* puts it, so its directory can still be cleaned up.
+*
+* The check stands between a name typed on a command line and an
+* `rm -rf`: an empty name, `..` or an app root of `/` must never reach it.
+* The path is checked as written, then, when it exists, with its symbolic
+* links followed: a symlinked project directory or parent directory could
+* otherwise point `ddev delete` and the removal at a directory outside the
+* projects directory.
+*/
+function resolveProjectDir(name, config) {
+	if (!name.trim() || name === "." || name === ".." || name.includes("/")) throw new Error(`Invalid project name: "${name}"`);
+	const projectsDir = resolve(config.projectsDir);
+	const appRoot = loadProjectList(config.projectListPath).get(name);
+	const dir = resolve(appRoot || join(projectsDir, name));
+	if (!isInside(projectsDir, dir)) throw new Error(`Refusing to remove ${dir}: it is not inside the projects directory ${projectsDir}. Set projects_dir in the agent config to the directory that \`trafic deploy\` uses`);
+	checkRealPath(dir, projectsDir);
+	return dir;
+}
+/**
+* Refuse an existing project directory that is a symbolic link, or that a
+* symbolic link in its path takes outside the projects directory. A path
+* that does not exist is left to the caller: there is nothing to remove.
+*/
+function checkRealPath(dir, projectsDir) {
+	let stats;
+	try {
+		stats = lstatSync(dir);
+	} catch (error) {
+		const { code } = error;
+		if (code === "ENOENT" || code === "ENOTDIR") return;
+		throw error;
+	}
+	if (stats.isSymbolicLink()) throw new Error(`Refusing to remove ${dir}: it is a symbolic link`);
+	const realDir = realpathSync(dir);
+	const realProjectsDir = realpathSync(projectsDir);
+	if (!isInside(realProjectsDir, realDir)) throw new Error(`Refusing to remove ${dir}: it resolves to ${realDir}, which is not inside the projects directory ${realProjectsDir}`);
+}
+/**
+* Refuse a backup directory that is the project directory or inside it: the
+* removal would delete the backup right after it is written. validateConfig
+* already refuses a backup.dir in projects_dir; this also follows symbolic
+* links. It checks `<backup.dir>/<name>`, where the backup goes, so a
+* symbolic link at that level is followed too.
+*/
+function checkBackupDir(backupDir, name, dir) {
+	const target = resolve(backupDir, name);
+	const realTarget = realpathOfNearest(target);
+	const realDir = realpathSync(dir);
+	if (target === dir || isInside(dir, target) || realTarget === realDir || isInside(realDir, realTarget)) throw new Error(`Refusing to back up to ${backupDir}: it is inside the project directory ${dir}, which the removal deletes`);
+}
+/**
+* The real path of a path that may not exist yet: the real path of its
+* nearest existing ancestor, plus the rest of the path. The backup creates
+* the missing directories through the symbolic links of that ancestor.
+*/
+function realpathOfNearest(path) {
+	const rest = [];
+	let current = path;
+	while (!existsSync(current)) {
+		const parent = dirname(current);
+		if (parent === current) break;
+		rest.unshift(basename(current));
+		current = parent;
+	}
+	return join(realpathSync(current), ...rest);
+}
+/** Whether a path is an existing directory. */
+function isDirectory(path) {
+	try {
+		return statSync(path).isDirectory();
+	} catch {
+		return false;
+	}
+}
+/**
+* Remove a project from the server.
+*
+* Steps:
+* 1. With `backup`, back up the database and the upload directories, all
+*    within `timeoutMs` when it is given
+* 2. Delete the DDEV project (containers, volumes, no snapshot)
+* 3. Remove the project directory
+* 4. Delete the project's records from the agent database
+*
+* A failed backup throws before anything is removed.
+*
+* A backup can take many minutes. With `beforeDelete`, the removal calls it
+* after the backup, just before step 2, and stops without removing anything
+* when it returns false: a scheduled removal that a deploy cancelled
+* meanwhile must not delete the new deploy.
+*
+* A failed `ddev delete` does not stop the removal: a project DDEV has
+* already forgotten could otherwise never be cleaned up, and the next deploy
+* would find a stale directory.
+*
+* While the removal runs, the project has the status "destroying", which the
+* idle sweep and max_running_projects never stop, and the waiting page never
+* starts: the backup can take many minutes, and a stop in the middle of it
+* fails the backup. The status is in the database, so the service sees it
+* when `trafic-agent destroy` runs from the command line. A removal that
+* fails sets the status back: "running" when it was, else "stopped". A
+* removal that is killed cannot: the status records the id of its process,
+* and the service sets it back to "running" once that process is gone (see
+* releaseStaleStatuses).
+*
+* The database must be open (`initDb`). Returns false when there was no
+* project directory or the removal was cancelled. Without a project
+* directory, the project's records are still deleted, so a retry after a run
+* that failed between steps 2 and 3 cleans them up. A cancelled removal
+* removes nothing and sets the status back.
+*/
+async function destroyProject(name, config, options = {}, run = nodeDdevRunner) {
+	const dir = resolveProjectDir(name, config);
+	if (!isDirectory(dir)) {
+		console.warn(deleteProject(name) ? `Project directory ${dir} does not exist: removed ${name} from the agent database` : `Project directory ${dir} does not exist — nothing to destroy`);
+		return false;
+	}
+	if (options.backup) checkBackupDir(config.backup.dir, name, dir);
+	const previous = getProject(name)?.status;
+	setProjectStatus(name, "destroying");
+	let removed;
+	try {
+		removed = await removeProject(name, dir, config, options, run);
+	} catch (error) {
+		setProjectStatus(name, previous === "running" ? "running" : "stopped");
+		throw error;
+	}
+	if (!removed) setProjectStatus(name, previous === "running" ? "running" : "stopped");
+	return removed;
+}
+/**
+* The steps of destroyProject, once the project is marked "destroying".
+* Returns false when the removal was cancelled after the backup.
+*/
+async function removeProject(name, dir, config, options, run) {
+	if (options.backup) {
+		console.log(`Backing up ${name}`);
+		await backupProject(name, dir, config.backup.dir, { timeoutMs: options.timeoutMs }, run);
+	}
+	if (options.beforeDelete && !options.beforeDelete()) {
+		console.log(`Removal of ${name} cancelled — nothing removed`);
+		return false;
+	}
+	console.log(`Deleting DDEV project: ${name}`);
+	const { ok } = await run(["delete", "-Oy"], DELETE_TIMEOUT_MS, dir);
+	if (!ok) console.warn("DDEV delete failed — project may not be a valid DDEV project");
+	console.log(`Removing ${dir}`);
+	rmSync(dir, {
+		recursive: true,
+		force: true
+	});
+	deleteProject(name);
+	console.log(`Destroyed: ${name}`);
+	return true;
+}
+//#endregion
+//#region src/tasks/destroy-scheduled.ts
+/** Hours, minutes and seconds, in this order: "48h", "1h30m", "90s". */
+var DELAY_REGEX = /^(?:\d+h)?(?:\d+m)?(?:\d+s)?$/;
+/**
+* Schedule the removal of a project, `delay` from now ("48h", "1h30m").
+*
+* The date goes to the agent database, not to the project: a redeploy does
+* not reliably rewrite the project files, and the sweep must find the date
+* even for a project DDEV has forgotten. The name is checked now, so a bad
+* name or a wrong `projects_dir` fails the CI job, not a sweep two days
+* later. With `backup`, the removal backs the project up first, within
+* `timeoutMs` when it is given. A removal that the sweep already started
+* cannot be scheduled again. Returns the date of the removal.
+*/
+function scheduleProjectDestroy(name, delay, config, options = {}, now = systemClock) {
+	const delayMs = DELAY_REGEX.test(delay) ? parseDuration(delay) : 0;
+	if (delayMs <= 0) throw new Error(`Invalid delay: "${delay}". Use hours, minutes or seconds, e.g. 48h or 1h30m`);
+	resolveProjectDir(name, config);
+	if (getScheduledDestroy(name)?.removing) throw new Error(`The removal of ${name} is in progress`);
+	const destroyAt = now() + delayMs;
+	scheduleDestroy(name, destroyAt, options.backup ?? false, options.timeoutMs);
+	return new Date(destroyAt);
+}
+/** A removal can take longer than the sweep interval; one sweep at a time. */
+var sweeping = false;
+/**
+* Remove each project whose scheduled removal is due, through the same
+* removal as `trafic-agent destroy`, with a backup when one was asked for.
+*
+* A failure on one project does not stop the sweep: it is logged, and the
+* removal stays scheduled so the next sweep tries again. A project already
+* gone has its schedule cleared.
+*
+* A removal can take minutes, and a deploy or a `--cancel` can cancel the
+* removal of a project meanwhile. So the sweep reads each removal again just
+* before it starts, and once more after the backup. There, it marks the
+* removal as started (startScheduledDestroy) before `ddev delete`: a later
+* cancel is refused, so the deploy fails instead of deploying a project
+* that is about to go. A retry of a started removal does not back the
+* project up again: the backup exists, and DDEV may have forgotten the
+* project already.
+*/
+async function destroyScheduledProjects(config, now = systemClock, run = nodeDdevRunner) {
+	if (sweeping) return;
+	sweeping = true;
+	try {
+		for (const { name } of getScheduledDestroys(now())) {
+			const scheduled = getScheduledDestroy(name, now());
+			if (!scheduled) continue;
+			console.log(`Destroying ${name}: its scheduled removal is ${scheduled.removing ? "in progress" : "due"}`);
+			try {
+				await destroyProject(name, config, {
+					backup: scheduled.backup && !scheduled.removing,
+					timeoutMs: scheduled.timeoutMs,
+					beforeDelete: () => startScheduledDestroy(name, now())
+				}, run);
+			} catch (error) {
+				console.error(`Scheduled removal of ${name} failed, retrying on the next sweep: ${error.message}`);
+			}
+		}
+	} finally {
+		sweeping = false;
+	}
+}
+/** A sweep that throws must not take the scheduler down with it. */
+function reportSweepError(error) {
+	console.error("Scheduled removal sweep failed:", error);
+}
+/**
+* Start the scheduled removal sweep, on the idle check interval
+*/
+function startScheduledDestroyScheduler(config) {
+	const intervalMs = parseDuration(config.idleCheckInterval);
+	console.log(`Scheduled removal sweep started: checking every ${config.idleCheckInterval}`);
+	destroyScheduledProjects(config).catch(reportSweepError);
+	return setInterval(() => {
+		destroyScheduledProjects(config).catch(reportSweepError);
+	}, intervalMs);
+}
+/** Retention is counted in days, so an hourly sweep is enough. */
+var SWEEP_INTERVAL_MS = 36e5;
+/** A sweep that throws must not take the scheduler down with it. */
+function sweepAccessLogs() {
+	try {
+		const removed = cleanOldLogs(30);
+		if (removed > 0) console.log(`Removed ${removed} access logs older than 30 days`);
+	} catch (error) {
+		console.error("Access log sweep failed:", error);
+	}
+}
+/**
+* Start the access log retention sweep. Each request logs a row, so without
+* it the database grows for good. The database must be open.
+*/
+function startAccessLogSweepScheduler() {
+	console.log(`Access log sweep started: removing access logs older than 30 days`);
+	sweepAccessLogs();
+	return setInterval(sweepAccessLogs, SWEEP_INTERVAL_MS);
+}
+//#endregion
 //#region src/setup/user.ts
 /**
 * Write /etc/sudoers.d/trafic-ddev allowing the ddev user to run
@@ -357,191 +1127,6 @@ function setupDockerPrune(io = nodeIo) {
 	success("Docker prune scheduled weekly at 3am on Sundays");
 }
 //#endregion
-//#region src/setup/agent.ts
-/** Node.js major version required by the agent */
-var NODE_MAJOR = 24;
-/** NodeSource keyring path */
-var NODESOURCE_KEYRING = "/etc/apt/keyrings/nodesource.gpg";
-/**
-* Add the NodeSource apt repository and GPG key.
-* Idempotent: safe to call even if the repository is already configured.
-*
-* nodejs.org points at NodeSource for apt installs. The Ubuntu 24.04
-* `nodejs` package is 18.x, far below what the agent needs.
-*/
-function addNodeSourceAptRepo(io = nodeIo) {
-	io.exec("install -m 0755 -d /etc/apt/keyrings", { silent: true });
-	io.exec("curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key -o /tmp/trafic-nodesource.key", { silent: true });
-	io.exec("gpg --batch --yes --dearmor -o /tmp/trafic-nodesource.gpg /tmp/trafic-nodesource.key", { silent: true });
-	io.exec(`install -m 0644 /tmp/trafic-nodesource.gpg ${NODESOURCE_KEYRING}`, { silent: true });
-	io.exec("rm -f /tmp/trafic-nodesource.key /tmp/trafic-nodesource.gpg", { silent: true });
-	io.exec(`echo "deb [signed-by=${NODESOURCE_KEYRING}] https://deb.nodesource.com/node_${NODE_MAJOR}.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list > /dev/null`, { silent: true });
-}
-/**
-* Install Node.js from the NodeSource apt repository.
-*
-* apt keeps node and npm in /usr/bin — on root's PATH, so `which
-* trafic-agent` resolves for the systemd unit — and unattended-upgrades
-* patches them, which a version manager install never gets.
-*/
-function installNode(io = nodeIo) {
-	step("Install Node.js");
-	if (io.commandExists("node")) {
-		const version = io.exec("node --version", { silent: true });
-		info(`Node.js already installed: ${version?.trim()}`);
-		return;
-	}
-	info("Adding NodeSource apt repository...");
-	addNodeSourceAptRepo(io);
-	info("Installing Node.js...");
-	io.exec("apt-get update -qq", { silent: true });
-	io.exec("DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y nodejs", { silent: true });
-	success(`Node.js ${NODE_MAJOR} installed from apt`);
-}
-/**
-* Install the Trafic agent
-*/
-function installAgent(io = nodeIo) {
-	step("Install Trafic agent");
-	io.exec("npm install -g @studiometa/trafic-agent");
-	success("Trafic agent installed");
-}
-/**
-* Create the agent configuration
-*/
-function createAgentConfig(options, io = nodeIo) {
-	const { tld, trustedProxyHops = 1, dnsProvider, dnsEnv = {} } = options;
-	step("Create agent configuration");
-	io.exec("mkdir -p /etc/trafic");
-	io.exec("mkdir -p /var/lib/trafic");
-	io.exec("chown ddev:ddev /var/lib/trafic");
-	const configPath = "/etc/trafic/config.toml";
-	const tlsSection = buildTlsSection(dnsProvider, dnsEnv);
-	if (io.fileExists(configPath)) {
-		info("Configuration already exists at /etc/trafic/config.toml — skipping");
-		info("Edit this file to configure authentication");
-		if (tlsSection) {
-			info("Add this to /etc/trafic/config.toml, then run `trafic-agent upgrade`:");
-			for (const line of buildTlsSection(dnsProvider, dnsEnv, true).trim().split("\n")) info(`  ${line}`);
-			info("Replace each REPLACE_ME with the value you passed to --dns-env.");
-		}
-		return;
-	}
-	const config = `# Trafic agent configuration
-# Generated by trafic setup
-
-# Required: TLD for DDEV projects
-tld = "${tld}"
-
-# Agent HTTP server port
-port = 9876
-
-# Database and paths
-db_path = "/var/lib/trafic/db.sqlite"
-project_list_path = "/home/ddev/.ddev/project_list.yaml"
-projects_dir = "/home/ddev/www"
-
-# Scale-to-zero settings
-idle_timeout = "4h"
-idle_check_interval = "5m"
-
-# Authentication
-[auth]
-default_policy = "basic"
-allowed_ips = []
-tokens = []
-basic_auth = []
-rules = []
-
-# Proxies in front of the agent, counted so the client address can be read
-# from X-Forwarded-For. 1 is ddev-router/Traefik alone. Raise it by one for
-# every extra proxy — a CDN or load balancer ahead of Traefik makes it 2.
-# Too low and allowed_ips matches a proxy instead of the client; too high and
-# it can be spoofed by a client-supplied header.
-trusted_proxy_hops = ${trustedProxyHops}
-${tlsSection}`;
-	io.writeFile(configPath, config);
-	io.exec("chmod 640 /etc/trafic/config.toml");
-	io.exec("chown root:ddev /etc/trafic/config.toml");
-	success("Configuration created at /etc/trafic/config.toml");
-	info("Edit this file to configure authentication");
-}
-/**
-* Build the [tls] section of the generated config.
-*
-* Empty without a DNS provider: per-host certificates stay the default, and
-* an empty section would only invite a half-filled one.
-*/
-function buildTlsSection(dnsProvider, dnsEnv, redact = false) {
-	if (!dnsProvider) return "";
-	const env = Object.entries(dnsEnv).map(([key, value]) => `${key} = "${redact ? "REPLACE_ME" : escapeTomlString(value)}"`).join("\n");
-	return `
-# Wildcard certificate (DNS-01). One *.<tld> certificate replaces the
-# per-hostname ones, so previews stop consuming the Let's Encrypt quota.
-[tls]
-dns_provider = "${escapeTomlString(dnsProvider)}"
-# ca_server = "https://acme-staging-v02.api.letsencrypt.org/directory"
-
-# Credentials the lego provider reads. Passed to the ddev-router container.
-[tls.dns_env]
-${env}
-`;
-}
-/** Escape a value for a basic (double-quoted) TOML string. */
-function escapeTomlString(value) {
-	return value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t");
-}
-/**
-* Create systemd service for the agent
-*/
-function createSystemdService(io = nodeIo) {
-	step("Create systemd service");
-	const serviceContent = `[Unit]
-Description=Trafic Agent - DDEV preview environment manager
-After=network.target docker.service
-Requires=docker.service
-
-[Service]
-Type=simple
-User=ddev
-Group=ddev
-ExecStart=${io.exec("which trafic-agent", { silent: true })?.trim() || "/usr/bin/trafic-agent"} start --config /etc/trafic/config.toml
-Restart=always
-RestartSec=5
-StandardOutput=journal
-StandardError=journal
-SyslogIdentifier=trafic-agent
-
-# Environment
-Environment=NODE_ENV=production
-# Skip ddev-hostname /etc/hosts management — on a server, hostnames resolve
-# to the public IP (not localhost), which would trigger ddev-hostname on every
-# ddev start. DDEV_NONINTERACTIVE=true skips that entirely.
-Environment=DDEV_NONINTERACTIVE=true
-
-# Security hardening
-NoNewPrivileges=true
-ProtectSystem=strict
-ProtectHome=read-only
-# ddev start writes across its own home: the project directory
-# (.ddev/.webimageBuild), buildx state in .docker, mutagen data. Listing
-# individual paths is whack-a-mole across DDEV versions, so grant the home
-# and leave the rest of /home read-only.
-ReadWritePaths=/var/lib/trafic /home/ddev
-PrivateTmp=true
-
-[Install]
-WantedBy=multi-user.target
-`;
-	io.writeFile("/etc/systemd/system/trafic-agent.service", serviceContent);
-	io.exec("chmod 644 /etc/systemd/system/trafic-agent.service");
-	io.exec("systemctl daemon-reload");
-	io.exec("systemctl enable trafic-agent");
-	io.exec("systemctl start trafic-agent");
-	success("Trafic agent service started");
-	info("View logs: journalctl -u trafic-agent -f");
-}
-//#endregion
 //#region src/setup/hardening.ts
 /** The sshd drop-in written by `setup`, and the only file hardening owns. */
 var SSHD_DROPIN = "/etc/ssh/sshd_config.d/trafic.conf";
@@ -1297,7 +1882,7 @@ http:
 };
 //#endregion
 //#region src/setup/migrations/0009__scale_to_zero_fixes.ts
-var UNIT_PATH = "/etc/systemd/system/trafic-agent.service";
+var UNIT_PATH$1 = "/etc/systemd/system/trafic-agent.service";
 var DYNAMIC_CONFIG$2 = "/home/ddev/.ddev/traefik/trafic.yaml";
 /**
 * Migration 0009: Make scale-to-zero actually work.
@@ -1324,7 +1909,7 @@ var migration0009ScaleToZeroFixes = {
 	id: "0009__scale_to_zero_fixes",
 	description: "Fix scale-to-zero: waiting page router and agent write access",
 	run() {
-		const unitNeedsWrite = !existsSync(UNIT_PATH) || !/^ReadWritePaths=.*\/home\/ddev(\s|$)/m.test(readFileSync(UNIT_PATH, "utf-8"));
+		const unitNeedsWrite = !existsSync(UNIT_PATH$1) || !/^ReadWritePaths=.*\/home\/ddev(\s|$)/m.test(readFileSync(UNIT_PATH$1, "utf-8"));
 		if (!existsSync(DYNAMIC_CONFIG$2) || !readFileSync(DYNAMIC_CONFIG$2, "utf-8").includes("trafic-catchall")) {
 			configureTraefik();
 			exec("su - ddev -c 'DDEV_NONINTERACTIVE=true ddev poweroff && ddev start --all'", { silent: true });
@@ -1782,6 +2367,38 @@ function parseTasks(output) {
 	}));
 }
 //#endregion
+//#region src/setup/migrations/0020__backup_dir.ts
+var UNIT_PATH = "/etc/systemd/system/trafic-agent.service";
+/**
+* Migration 0020: let the agent service write to the backup directory.
+*
+* The agent now removes old backups from /var/backups/trafic in a periodic
+* sweep, but the unit runs with `ProtectSystem=strict` and only lists
+* /var/lib/trafic and /home/ddev in `ReadWritePaths`, so every removal would
+* fail with a read-only file system error.
+*
+* Creates the directory first: hardening created it, but a server set up with
+* `--no-hardening` has none, and the ddev user cannot create it in
+* /var/backups. Then rewrites the unit, which lists the directory with the
+* `-` prefix: systemd refuses to start a unit whose `ReadWritePaths` names a
+* missing path, unless the path has that prefix.
+*
+* Idempotent: the unit is rewritten only while it does not list the backup
+* directory with the `-` prefix.
+*/
+var migration0020BackupDir = {
+	id: "0020__backup_dir",
+	description: "Let the agent service write to the backup directory",
+	run() {
+		runBackupDirMigration();
+	}
+};
+/** The migration body, with its effects injected so tests can drive it. */
+function runBackupDirMigration(io = nodeIo) {
+	createBackupDir$1(io);
+	if (!(io.fileExists(UNIT_PATH) && new RegExp(`^ReadWritePaths=.*\\s-/var/backups/trafic(\\s|$)`, "m").test(io.readFile(UNIT_PATH)))) createSystemdService(io);
+}
+//#endregion
 //#region src/setup/migrations/index.ts
 /** Path to the persisted migration state file */
 var MIGRATIONS_STATE_FILE = "/etc/trafic/.migrations.json";
@@ -1805,7 +2422,8 @@ var ALL_MIGRATIONS = [
 	migration0016WildcardDnsChallenge,
 	migration0018DockerAddressPools,
 	migration0017DdevAptCloudsmith,
-	migration0019RecoverOrphanContainers
+	migration0019RecoverOrphanContainers,
+	migration0020BackupDir
 ];
 /**
 * Load the current migration state from disk.
@@ -1961,6 +2579,6 @@ async function audit() {
 	if (checks.filter((c) => c.status === "fail").length > 0) process.exit(1);
 }
 //#endregion
-export { printAuditResults as a, stopIdleProjects as c, buildDockerFirewallScript as d, buildDockerFirewallUnit as f, runPendingMigrations as i, DOCKER_FIREWALL_SCRIPT as l, setup as n, runAudit as o, configureDockerFirewall as p, listMigrations as r, startIdleScheduler as s, audit as t, DOCKER_FIREWALL_UNIT as u };
+export { configureDockerFirewall as C, buildDockerFirewallUnit as S, startIdleScheduler as _, printAuditResults as a, DOCKER_FIREWALL_UNIT as b, destroyScheduledProjects as c, destroyProject as d, loadDestroyConfig as f, startBackupSweepScheduler as g, removeOldBackups as h, runPendingMigrations as i, scheduleProjectDestroy as l, backupProject as m, setup as n, runAudit as o, openDestroyDb as p, listMigrations as r, startAccessLogSweepScheduler as s, audit as t, startScheduledDestroyScheduler as u, stopIdleProjects as v, buildDockerFirewallScript as x, DOCKER_FIREWALL_SCRIPT as y };
 
-//# sourceMappingURL=setup-DWgb6dAD.js.map
+//# sourceMappingURL=setup-CiWIirVb.js.map