@studiometa/trafic-agent 0.1.7 → 0.1.9

package/dist/setup-CVf8YfPW.js

@@ -0,0 +1,941 @@
+import { _ as getProjectInfo, i as shouldNeverStop, l as getIdleProjects, n as getIdleTimeoutMs, p as setProjectStatus, r as loadProjectConfig, x as stopProject, y as loadProjectList } from "./server-D0N_6y4c.js";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { parse } from "smol-toml";
+import { execSync } from "node:child_process";
+var DEFAULT_CONFIG_PATHS = [
+	"/etc/trafic/config.toml",
+	"./config.toml",
+	"./trafic.toml"
+];
+var DEFAULT_CONFIG = {
+	tld: "",
+	port: 9876,
+	dbPath: "/var/lib/trafic/db.sqlite",
+	projectListPath: "/home/ddev/.ddev/project_list.yaml",
+	projectsDir: "/home/ddev/www",
+	idleTimeout: "30m",
+	idleCheckInterval: "5m",
+	auth: {
+		defaultPolicy: "basic",
+		allowedIps: [],
+		tokens: [],
+		basicAuth: [],
+		rules: []
+	}
+};
+/**
+* Parse a duration string (e.g., "30m", "1h", "2h30m") to milliseconds
+*/
+function parseDuration(duration) {
+	const match = duration.match(/(?:(\d+)h)?(?:(\d+)m)?(?:(\d+)s)?/);
+	if (!match) return 0;
+	const hours = parseInt(match[1] ?? "0", 10);
+	const minutes = parseInt(match[2] ?? "0", 10);
+	const seconds = parseInt(match[3] ?? "0", 10);
+	return (hours * 3600 + minutes * 60 + seconds) * 1e3;
+}
+/**
+* Load configuration from TOML file
+*/
+function loadConfig(configPath) {
+	let path = configPath;
+	if (!path) path = DEFAULT_CONFIG_PATHS.find((p) => existsSync(p));
+	if (!path || !existsSync(path)) {
+		console.warn("No config file found, using defaults");
+		return DEFAULT_CONFIG;
+	}
+	const parsed = parse(readFileSync(path, "utf-8"));
+	const auth = mergeAuthConfig(parsed.auth);
+	return {
+		tld: parsed.tld ?? DEFAULT_CONFIG.tld,
+		port: parsed.port ?? DEFAULT_CONFIG.port,
+		dbPath: parsed.db_path ?? DEFAULT_CONFIG.dbPath,
+		projectListPath: parsed.project_list_path ?? DEFAULT_CONFIG.projectListPath,
+		projectsDir: parsed.projects_dir ?? DEFAULT_CONFIG.projectsDir,
+		idleTimeout: parsed.idle_timeout ?? DEFAULT_CONFIG.idleTimeout,
+		idleCheckInterval: parsed.idle_check_interval ?? DEFAULT_CONFIG.idleCheckInterval,
+		auth
+	};
+}
+function mergeAuthConfig(raw) {
+	if (!raw) return DEFAULT_CONFIG.auth;
+	const rules = raw.rules ?? [];
+	return {
+		defaultPolicy: raw.default_policy ?? DEFAULT_CONFIG.auth.defaultPolicy,
+		allowedIps: raw.allowed_ips ?? DEFAULT_CONFIG.auth.allowedIps,
+		tokens: raw.tokens ?? DEFAULT_CONFIG.auth.tokens,
+		basicAuth: raw.basic_auth ?? DEFAULT_CONFIG.auth.basicAuth,
+		rules: rules.map((r) => ({
+			match: r.match,
+			policy: r.policy,
+			tokens: r.tokens,
+			allowedIps: r.allowed_ips
+		}))
+	};
+}
+/**
+* Validate configuration
+*/
+function validateConfig(config) {
+	const errors = [];
+	if (!config.tld) errors.push("tld is required");
+	if (config.port < 1 || config.port > 65535) errors.push("port must be between 1 and 65535");
+	if (config.auth.defaultPolicy !== "allow" && config.auth.defaultPolicy !== "deny" && config.auth.defaultPolicy !== "basic" && config.auth.defaultPolicy !== "token") errors.push("auth.default_policy must be \"allow\", \"deny\", \"basic\", or \"token\"");
+	return errors;
+}
+/**
+* Stop idle projects that haven't been accessed recently
+* Respects per-project idle_timeout settings from .ddev/config.trafic.yaml
+*/
+function stopIdleProjects(config) {
+	const globalThresholdMs = parseDuration(config.idleTimeout);
+	const projects = loadProjectList(config.projectListPath);
+	const idleProjects = getIdleProjects(globalThresholdMs);
+	for (const project of idleProjects) {
+		const projectDir = projects.get(project.name);
+		if (projectDir) {
+			const projectConfig = loadProjectConfig(projectDir);
+			if (shouldNeverStop(projectConfig)) continue;
+			const projectThresholdMs = getIdleTimeoutMs(projectConfig);
+			if (projectThresholdMs !== void 0) {
+				if (Date.now() - project.lastAccess < projectThresholdMs) continue;
+			}
+		}
+		if (getProjectInfo(project.name)?.status !== "running") {
+			setProjectStatus(project.name, "stopped");
+			continue;
+		}
+		console.log(`Stopping idle project: ${project.name}`);
+		if (stopProject(project.name)) {
+			setProjectStatus(project.name, "stopped");
+			console.log(`Stopped: ${project.name}`);
+		} else console.error(`Failed to stop: ${project.name}`);
+	}
+}
+/**
+* Start the idle check scheduler
+*/
+function startIdleScheduler(config) {
+	const intervalMs = parseDuration(config.idleCheckInterval);
+	console.log(`Idle scheduler started: checking every ${config.idleCheckInterval}, timeout ${config.idleTimeout}`);
+	stopIdleProjects(config);
+	return setInterval(() => {
+		stopIdleProjects(config);
+	}, intervalMs);
+}
+var stepNumber = 0;
+var dryRun = false;
+/**
+* Set dry-run mode
+*/
+function setDryRun(value) {
+	dryRun = value;
+}
+/**
+* Reset step counter
+*/
+function resetSteps() {
+	stepNumber = 0;
+}
+/**
+* Log a step
+*/
+function step(message) {
+	stepNumber++;
+	console.log(`\n\x1b[36m[${stepNumber}]\x1b[0m ${message}`);
+}
+/**
+* Log success
+*/
+function success(message) {
+	console.log(`    \x1b[32m✓\x1b[0m ${message}`);
+}
+/**
+* Log warning
+*/
+function warn(message) {
+	console.log(`    \x1b[33m⚠\x1b[0m ${message}`);
+}
+/**
+* Log error
+*/
+function error(message) {
+	console.log(`    \x1b[31m✗\x1b[0m ${message}`);
+}
+/**
+* Log info
+*/
+function info(message) {
+	console.log(`    ${message}`);
+}
+/**
+* Execute a command (or show in dry-run mode)
+*/
+function exec(command, options) {
+	if (dryRun) {
+		if (!options?.silent) console.log(`    \x1b[90m$ ${command}\x1b[0m`);
+		return "";
+	}
+	try {
+		return execSync(command, {
+			encoding: "utf-8",
+			stdio: options?.silent ? "pipe" : "inherit"
+		});
+	} catch (err) {
+		const e = err;
+		throw new Error(`Command failed: ${command}\n${e.stderr ?? ""}`);
+	}
+}
+/**
+* Execute a command and return output (silent)
+*/
+function execSilent$1(command) {
+	if (dryRun) return "";
+	try {
+		return execSync(command, {
+			encoding: "utf-8",
+			stdio: "pipe"
+		}).trim();
+	} catch {
+		return "";
+	}
+}
+/**
+* Check if a command exists
+*/
+function commandExists(command) {
+	try {
+		execSync(`which ${command}`, { stdio: "pipe" });
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Check if running as root
+*/
+function isRoot() {
+	return process.getuid?.() === 0;
+}
+/**
+* Create the ddev user with proper permissions
+*/
+function createDdevUser() {
+	step("Create ddev user");
+	if (execSilent$1("id -u ddev 2>/dev/null")) info("User 'ddev' already exists");
+	else {
+		exec("useradd -m -s /bin/bash ddev");
+		success("Created user 'ddev'");
+	}
+	exec("usermod -aG docker ddev 2>/dev/null || true", { silent: true });
+	exec("mkdir -p /home/ddev/www");
+	exec("chown ddev:ddev /home/ddev/www");
+	exec("chmod 750 /home/ddev/www");
+	success("Created /home/ddev/www");
+	exec("mkdir -p /home/ddev/.ssh");
+	exec("chmod 700 /home/ddev/.ssh");
+	exec("chown ddev:ddev /home/ddev/.ssh");
+	success("User ddev configured (no sudo needed with proper DNS)");
+}
+/**
+* Install Docker using the official script
+*/
+function installDocker() {
+	step("Install Docker");
+	if (commandExists("docker")) {
+		info(`Docker already installed: ${exec("docker --version", { silent: true })?.trim() ?? "unknown version"}`);
+		return;
+	}
+	info("Downloading and running Docker install script...");
+	exec("curl -fsSL https://get.docker.com -o /tmp/get-docker.sh");
+	exec("sh /tmp/get-docker.sh", { silent: true });
+	exec("rm /tmp/get-docker.sh");
+	exec("systemctl enable docker", { silent: true });
+	exec("systemctl start docker", { silent: true });
+	success("Docker installed and started");
+	exec("usermod -aG docker ddev", { silent: true });
+	success("Added ddev user to docker group");
+}
+/**
+* Configure Docker for production use
+*/
+function configureDocker() {
+	step("Configure Docker");
+	const daemonConfig = {
+		"log-driver": "json-file",
+		"log-opts": {
+			"max-size": "10m",
+			"max-file": "3"
+		},
+		"storage-driver": "overlay2",
+		"live-restore": true
+	};
+	exec("mkdir -p /etc/docker");
+	const configPath = "/etc/docker/daemon.json";
+	if (existsSync(configPath)) try {
+		const merged = {
+			...JSON.parse(readFileSync(configPath, "utf-8")),
+			...daemonConfig
+		};
+		writeFileSync(configPath, JSON.stringify(merged, null, 2));
+		info("Merged with existing Docker config");
+	} catch {
+		warn("Could not parse existing Docker config, skipping");
+		return;
+	}
+	else writeFileSync(configPath, JSON.stringify(daemonConfig, null, 2));
+	exec("systemctl reload docker || systemctl restart docker");
+	success("Docker configured with production settings");
+}
+/**
+* Setup Docker system prune cron job
+*/
+function setupDockerPrune() {
+	step("Setup Docker cleanup cron");
+	writeFileSync("/etc/cron.d/trafic-docker-prune", `# Trafic: Clean up Docker resources weekly
+0 3 * * 0 root docker system prune -af --volumes 2>&1 | logger -t docker-prune
+`);
+	exec("chmod 644 /etc/cron.d/trafic-docker-prune");
+	success("Docker prune scheduled weekly at 3am on Sundays");
+}
+/**
+* Install system dependencies required by Trafic
+*/
+function installSystemDeps() {
+	step("Install system dependencies");
+	exec("apt-get update -qq", { silent: true });
+	exec("DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y jq curl rsync", { silent: true });
+	success("System dependencies installed: jq, curl, rsync");
+}
+/**
+* Install DDEV
+*/
+function installDdev() {
+	step("Install DDEV");
+	if (commandExists("ddev")) {
+		info(`DDEV already installed: ${exec("ddev --version 2>/dev/null | head -1", { silent: true })?.trim() ?? "unknown version"}`);
+		return;
+	}
+	info("Fetching latest DDEV version...");
+	const latestVersion = exec("curl -fsSL https://api.github.com/repos/ddev/ddev/releases/latest | grep '\"tag_name\"' | sed -E 's/.*\"([^\"]+)\".*/\\1/'", { silent: true })?.trim();
+	if (!latestVersion) throw new Error("Could not determine latest DDEV version");
+	info(`Installing DDEV ${latestVersion}...`);
+	const arch = exec("uname -m", { silent: true })?.trim() === "x86_64" ? "amd64" : "arm64";
+	const tarball = `ddev_linux-${arch}.${latestVersion}.tar.gz`;
+	exec(`curl -fsSL -o /tmp/${tarball} ${`https://github.com/ddev/ddev/releases/download/${latestVersion}/${tarball}`}`, { silent: true });
+	exec(`tar -xzf /tmp/${tarball} -C /tmp ddev`, { silent: true });
+	exec("mv /tmp/ddev /usr/local/bin/ddev", { silent: true });
+	exec("chmod +x /usr/local/bin/ddev", { silent: true });
+	exec(`rm -f /tmp/${tarball}`, { silent: true });
+	info("Installing mkcert...");
+	const mkcertVersion = exec("curl -fsSL https://api.github.com/repos/FiloSottile/mkcert/releases/latest | grep '\"tag_name\"' | sed -E 's/.*\"([^\"]+)\".*/\\1/'", { silent: true })?.trim();
+	if (mkcertVersion) {
+		exec(`curl -fsSL -o /usr/local/bin/mkcert https://github.com/FiloSottile/mkcert/releases/download/${mkcertVersion}/${`mkcert-${mkcertVersion}-linux-${arch}`}`, { silent: true });
+		exec("chmod +x /usr/local/bin/mkcert", { silent: true });
+	}
+	success(`DDEV ${latestVersion} installed`);
+}
+/**
+* Configure DDEV global settings for production
+*
+* Note on DNS and /etc/hosts:
+* When using a custom TLD (not ddev.site), DDEV may try to edit /etc/hosts
+* if it can't resolve project hostnames via DNS. To avoid this:
+* 1. Configure DNS so *.{tld} resolves to the server's IP (recommended)
+* 2. Or install dnsmasq for local wildcard DNS resolution
+*
+* With proper DNS, DDEV won't need sudo for hostname management.
+*/
+function configureDdev(tld, email) {
+	step("Configure DDEV");
+	const ddevCmd = (cmd) => `su - ddev -c '${cmd}'`;
+	exec(ddevCmd(`ddev config global --project-tld=${tld} --router-http-port=80 --router-https-port=443 --use-letsencrypt=${email ? "true" : "false"} ${email ? `--letsencrypt-email=${email}` : ""} --instrumentation-opt-in=false`), { silent: true });
+	success(`DDEV configured with TLD: ${tld}`);
+	info(`Ensure DNS is configured: *.${tld} → server IP`);
+	if (email) success(`Let's Encrypt enabled with email: ${email}`);
+	success("DDEV global settings configured");
+}
+/**
+* Configure Traefik for forward auth
+*/
+function configureTraefik() {
+	step("Configure Traefik for forward auth");
+	exec("mkdir -p /home/ddev/.ddev/traefik", { silent: true });
+	exec("chown -R ddev:ddev /home/ddev/.ddev", { silent: true });
+	writeFileSync("/home/ddev/.ddev/traefik/trafic.yaml", `# Trafic: Forward auth middleware
+http:
+  middlewares:
+    trafic-auth:
+      forwardAuth:
+        address: "http://host.docker.internal:9876/__auth__"
+        authResponseHeaders:
+          - "X-Trafic-Project"
+
+    trafic-errors:
+      errors:
+        status:
+          - "502"
+          - "503"
+        service: trafic-service
+        query: "/"
+
+  services:
+    trafic-service:
+      loadBalancer:
+        servers:
+          - url: "http://host.docker.internal:9876"
+`);
+	exec("chown ddev:ddev /home/ddev/.ddev/traefik/trafic.yaml", { silent: true });
+	writeFileSync("/home/ddev/.ddev/traefik/dynamic.yaml", `# Trafic: Default router configuration
+# This file makes all DDEV projects use the Trafic auth middleware
+http:
+  routers:
+    trafic-catch-all:
+      rule: "HostRegexp(\`.+\`)"
+      priority: 1
+      middlewares:
+        - trafic-auth
+        - trafic-errors
+      service: api@internal
+`);
+	exec("chown ddev:ddev /home/ddev/.ddev/traefik/dynamic.yaml", { silent: true });
+	success("Traefik configured with Trafic middleware");
+}
+/**
+* Install Node.js using fnm
+*/
+function installNode() {
+	step("Install Node.js");
+	if (commandExists("node")) {
+		info(`Node.js already installed: ${exec("node --version", { silent: true })?.trim()}`);
+		return;
+	}
+	exec("curl -fsSL https://fnm.vercel.app/install | bash -s -- --install-dir \"/opt/fnm\" --skip-shell");
+	writeFileSync("/etc/profile.d/fnm.sh", `# Trafic: fnm (Node.js version manager)
+export FNM_DIR="/opt/fnm"
+export PATH="/opt/fnm:$PATH"
+eval "$(fnm env)"
+`);
+	exec("chmod 644 /etc/profile.d/fnm.sh");
+	exec("export FNM_DIR=/opt/fnm && /opt/fnm/fnm install 24");
+	exec("export FNM_DIR=/opt/fnm && /opt/fnm/fnm default 24");
+	exec("ln -sf /opt/fnm/aliases/default/bin/node /usr/local/bin/node || true");
+	exec("ln -sf /opt/fnm/aliases/default/bin/npm /usr/local/bin/npm || true");
+	exec("ln -sf /opt/fnm/aliases/default/bin/npx /usr/local/bin/npx || true");
+	success("Node.js 24 installed via fnm");
+}
+/**
+* Install the Trafic agent
+*/
+function installAgent() {
+	step("Install Trafic agent");
+	exec("npm install -g @studiometa/trafic-agent");
+	success("Trafic agent installed");
+}
+/**
+* Create the agent configuration
+*/
+function createAgentConfig(tld, _email) {
+	step("Create agent configuration");
+	exec("mkdir -p /etc/trafic");
+	exec("mkdir -p /var/lib/trafic");
+	exec("chown ddev:ddev /var/lib/trafic");
+	const configPath = "/etc/trafic/config.toml";
+	if (existsSync(configPath)) {
+		info("Configuration already exists at /etc/trafic/config.toml — skipping");
+		info("Edit this file to configure authentication");
+		return;
+	}
+	writeFileSync(configPath, `# Trafic agent configuration
+# Generated by trafic setup
+
+# Required: TLD for DDEV projects
+tld = "${tld}"
+
+# Agent HTTP server port
+port = 9876
+
+# Database and paths
+db_path = "/var/lib/trafic/db.sqlite"
+project_list_path = "/home/ddev/.ddev/project_list.yaml"
+projects_dir = "/home/ddev/www"
+
+# Scale-to-zero settings
+idle_timeout = "4h"
+idle_check_interval = "5m"
+
+# Authentication
+[auth]
+default_policy = "basic"
+allowed_ips = []
+tokens = []
+basic_auth = []
+rules = []
+`);
+	exec("chmod 640 /etc/trafic/config.toml");
+	exec("chown root:ddev /etc/trafic/config.toml");
+	success("Configuration created at /etc/trafic/config.toml");
+	info("Edit this file to configure authentication");
+}
+/**
+* Create systemd service for the agent
+*/
+function createSystemdService() {
+	step("Create systemd service");
+	writeFileSync("/etc/systemd/system/trafic-agent.service", `[Unit]
+Description=Trafic Agent - DDEV preview environment manager
+After=network.target docker.service
+Requires=docker.service
+
+[Service]
+Type=simple
+User=ddev
+Group=ddev
+ExecStart=${exec("which trafic-agent", { silent: true })?.trim() || "/usr/bin/trafic-agent"} start --config /etc/trafic/config.toml
+Restart=always
+RestartSec=5
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=trafic-agent
+
+# Environment
+Environment=NODE_ENV=production
+# Skip ddev-hostname /etc/hosts management — on a server, hostnames resolve
+# to the public IP (not localhost), which would trigger ddev-hostname on every
+# ddev start. DDEV_NONINTERACTIVE=true skips that entirely.
+Environment=DDEV_NONINTERACTIVE=true
+
+# Security hardening
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=read-only
+ReadWritePaths=/var/lib/trafic /home/ddev/.ddev
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target
+`);
+	exec("chmod 644 /etc/systemd/system/trafic-agent.service");
+	exec("systemctl daemon-reload");
+	exec("systemctl enable trafic-agent");
+	exec("systemctl start trafic-agent");
+	success("Trafic agent service started");
+	info("View logs: journalctl -u trafic-agent -f");
+}
+/**
+* Configure SSH hardening
+*/
+function hardenSsh(allowedUsers = ["ddev"]) {
+	step("Harden SSH configuration");
+	writeFileSync("/etc/ssh/sshd_config.d/trafic.conf", `# Trafic SSH hardening
+# Generated by trafic setup
+
+# Allow root login via SSH key only (no password) — required for server management
+PermitRootLogin prohibit-password
+
+# Disable password authentication (keys only)
+PasswordAuthentication no
+PubkeyAuthentication yes
+
+# Limit authentication attempts
+MaxAuthTries 3
+
+# Idle timeout (5 minutes)
+ClientAliveInterval 300
+ClientAliveCountMax 2
+
+# Allowed users (root kept for emergency access)
+AllowUsers root ${allowedUsers.join(" ")}
+
+# Disable X11 forwarding
+X11Forwarding no
+
+# Disable TCP forwarding
+AllowTcpForwarding no
+
+# Use strong algorithms only
+KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com
+MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
+`);
+	exec("chmod 644 /etc/ssh/sshd_config.d/trafic.conf");
+	if (exec("sshd -t 2>&1 || echo 'error'", { silent: true })?.includes("error")) {
+		warn("SSH config test failed, reverting...");
+		exec("rm /etc/ssh/sshd_config.d/trafic.conf");
+		return;
+	}
+	exec("systemctl reload ssh || systemctl reload sshd");
+	success("SSH hardened: password auth disabled, root key-only login retained");
+	info(`Allowed users: root, ${allowedUsers.join(", ")}`);
+}
+/**
+* Configure UFW firewall
+*/
+function configureFirewall() {
+	step("Configure firewall (UFW)");
+	if (!commandExists("ufw")) exec("DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y ufw", { silent: true });
+	exec("ufw --force reset", { silent: true });
+	exec("ufw default deny incoming");
+	exec("ufw default allow outgoing");
+	exec("ufw allow 22/tcp comment 'SSH'");
+	exec("ufw allow 80/tcp comment 'HTTP'");
+	exec("ufw allow 443/tcp comment 'HTTPS'");
+	exec("ufw --force enable");
+	success("Firewall enabled: SSH (22), HTTP (80), HTTPS (443) allowed");
+}
+/**
+* Configure automatic security updates
+*/
+function configureUnattendedUpgrades() {
+	step("Configure automatic security updates");
+	exec("DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y unattended-upgrades apt-listchanges", { silent: true });
+	writeFileSync("/etc/apt/apt.conf.d/50unattended-upgrades", `// Trafic: Automatic security updates
+Unattended-Upgrade::Allowed-Origins {
+    "\${distro_id}:\${distro_codename}";
+    "\${distro_id}:\${distro_codename}-security";
+    "\${distro_id}ESMApps:\${distro_codename}-apps-security";
+    "\${distro_id}ESM:\${distro_codename}-infra-security";
+};
+
+// Do not automatically reboot
+Unattended-Upgrade::Automatic-Reboot "false";
+
+// Remove unused dependencies
+Unattended-Upgrade::Remove-Unused-Dependencies "true";
+
+// Email notifications (optional)
+// Unattended-Upgrade::Mail "root";
+`);
+	writeFileSync("/etc/apt/apt.conf.d/20auto-upgrades", `APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Download-Upgradeable-Packages "1";
+APT::Periodic::AutocleanInterval "7";
+APT::Periodic::Unattended-Upgrade "1";
+`);
+	exec("systemctl enable unattended-upgrades");
+	exec("systemctl start unattended-upgrades");
+	success("Automatic security updates enabled");
+}
+/**
+* Configure Fail2ban
+*/
+function configureFail2ban() {
+	step("Configure Fail2ban");
+	if (!commandExists("fail2ban-client")) exec("DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y fail2ban", { silent: true });
+	writeFileSync("/etc/fail2ban/jail.local", `# Trafic: Fail2ban configuration
+[DEFAULT]
+bantime = 3600
+findtime = 600
+maxretry = 5
+backend = auto
+
+[sshd]
+enabled = true
+port = ssh
+filter = sshd
+logpath = /var/log/auth.log
+maxretry = 3
+bantime = 7200
+`);
+	exec("chmod 644 /etc/fail2ban/jail.local");
+	exec("systemctl enable fail2ban");
+	exec("systemctl restart fail2ban");
+	success("Fail2ban enabled: SSH brute force protection active");
+}
+/**
+* Configure system limits
+*/
+function configureSystemLimits() {
+	step("Configure system limits");
+	writeFileSync("/etc/security/limits.d/trafic.conf", `# Trafic: System limits for ddev user
+ddev soft nofile 65536
+ddev hard nofile 65536
+ddev soft nproc 4096
+ddev hard nproc 4096
+`);
+	exec("chmod 644 /etc/security/limits.d/trafic.conf");
+	success("System limits configured for ddev user");
+}
+/**
+* Set proper file permissions
+*/
+function configureFilePermissions() {
+	step("Configure file permissions");
+	exec("mkdir -p /etc/trafic");
+	exec("mkdir -p /var/lib/trafic");
+	exec("mkdir -p /var/backups/trafic");
+	exec("chmod 755 /etc/trafic");
+	exec("chmod 700 /var/lib/trafic");
+	exec("chmod 700 /var/backups/trafic");
+	exec("chown root:ddev /etc/trafic");
+	exec("chown ddev:ddev /var/lib/trafic");
+	exec("chown ddev:ddev /var/backups/trafic");
+	if (existsSync("/etc/trafic/config.toml")) {
+		exec("chmod 640 /etc/trafic/config.toml");
+		exec("chown root:ddev /etc/trafic/config.toml");
+	}
+	success("File permissions configured");
+}
+/**
+* Run all hardening steps
+*/
+function hardenServer(sshUsers = ["ddev"]) {
+	hardenSsh(sshUsers);
+	configureFirewall();
+	configureUnattendedUpgrades();
+	configureFail2ban();
+	configureSystemLimits();
+	configureFilePermissions();
+}
+/**
+* Run a command silently and return output
+*/
+function execSilent(command) {
+	try {
+		return execSync(command, {
+			encoding: "utf-8",
+			stdio: "pipe"
+		}).trim();
+	} catch {
+		return "";
+	}
+}
+/**
+* Check if a service is active
+*/
+function isServiceActive(service) {
+	return execSilent(`systemctl is-active ${service}`) === "active";
+}
+/**
+* Audit SSH configuration
+*/
+function auditSsh() {
+	const checks = [];
+	const sshdConfig = existsSync("/etc/ssh/sshd_config") ? readFileSync("/etc/ssh/sshd_config", "utf-8") : "";
+	const traficConfig = existsSync("/etc/ssh/sshd_config.d/trafic.conf") ? readFileSync("/etc/ssh/sshd_config.d/trafic.conf", "utf-8") : "";
+	const config = sshdConfig + "\n" + traficConfig;
+	const rootLoginDisabled = config.includes("PermitRootLogin no") || config.includes("PermitRootLogin prohibit-password");
+	checks.push({
+		name: "SSH root login",
+		status: rootLoginDisabled ? "pass" : "fail",
+		message: rootLoginDisabled ? "Root login disabled" : "Root login may be enabled",
+		fix: "Add 'PermitRootLogin no' to /etc/ssh/sshd_config.d/trafic.conf"
+	});
+	const passwordAuthDisabled = config.includes("PasswordAuthentication no");
+	checks.push({
+		name: "SSH password auth",
+		status: passwordAuthDisabled ? "pass" : "warn",
+		message: passwordAuthDisabled ? "Password authentication disabled" : "Password authentication may be enabled",
+		fix: "Add 'PasswordAuthentication no' to /etc/ssh/sshd_config.d/trafic.conf"
+	});
+	return checks;
+}
+/**
+* Audit firewall configuration
+*/
+function auditFirewall() {
+	const checks = [];
+	const ufwStatus = execSilent("ufw status");
+	const isActive = ufwStatus.includes("Status: active");
+	checks.push({
+		name: "Firewall (UFW)",
+		status: isActive ? "pass" : "fail",
+		message: isActive ? "UFW is active" : "UFW is not active",
+		fix: "Run: ufw enable"
+	});
+	if (isActive) {
+		const allows22 = ufwStatus.includes("22/tcp");
+		const allows80 = ufwStatus.includes("80/tcp");
+		const allows443 = ufwStatus.includes("443/tcp");
+		if (allows22 && allows80 && allows443) checks.push({
+			name: "Firewall ports",
+			status: "pass",
+			message: "Required ports (22, 80, 443) are open"
+		});
+		else checks.push({
+			name: "Firewall ports",
+			status: "warn",
+			message: "Some required ports may be blocked",
+			fix: "Run: ufw allow 22/tcp && ufw allow 80/tcp && ufw allow 443/tcp"
+		});
+	}
+	return checks;
+}
+/**
+* Audit security services
+*/
+function auditServices() {
+	const checks = [];
+	const fail2banActive = isServiceActive("fail2ban");
+	checks.push({
+		name: "Fail2ban",
+		status: fail2banActive ? "pass" : "warn",
+		message: fail2banActive ? "Fail2ban is active" : "Fail2ban is not running",
+		fix: "Run: apt install fail2ban && systemctl enable fail2ban --now"
+	});
+	const unattendedActive = isServiceActive("unattended-upgrades");
+	checks.push({
+		name: "Automatic updates",
+		status: unattendedActive ? "pass" : "warn",
+		message: unattendedActive ? "Unattended upgrades enabled" : "Automatic updates not configured",
+		fix: "Run: apt install unattended-upgrades && dpkg-reconfigure unattended-upgrades"
+	});
+	const agentActive = isServiceActive("trafic-agent");
+	checks.push({
+		name: "Trafic agent",
+		status: agentActive ? "pass" : "fail",
+		message: agentActive ? "Trafic agent is running" : "Trafic agent is not running",
+		fix: "Run: systemctl start trafic-agent"
+	});
+	return checks;
+}
+/**
+* Audit Docker
+*/
+function auditDocker() {
+	const checks = [];
+	const dockerActive = isServiceActive("docker");
+	checks.push({
+		name: "Docker",
+		status: dockerActive ? "pass" : "fail",
+		message: dockerActive ? "Docker is running" : "Docker is not running",
+		fix: "Run: systemctl start docker"
+	});
+	const danglingImages = execSilent("docker images -f dangling=true -q | wc -l");
+	const count = parseInt(danglingImages, 10) || 0;
+	if (count > 0) checks.push({
+		name: "Docker cleanup",
+		status: "warn",
+		message: `${count} dangling Docker images`,
+		fix: "Run: docker system prune -f"
+	});
+	const diskUsage = execSilent("df -h / | awk 'NR==2{print $5}'");
+	const usagePercent = parseInt(diskUsage, 10) || 0;
+	checks.push({
+		name: "Disk usage",
+		status: usagePercent > 90 ? "fail" : usagePercent > 80 ? "warn" : "pass",
+		message: `Disk usage: ${diskUsage}`,
+		fix: usagePercent > 80 ? "Consider cleaning up old projects or Docker resources" : void 0
+	});
+	return checks;
+}
+/**
+* Audit file permissions
+*/
+function auditPermissions() {
+	const checks = [];
+	if (existsSync("/etc/trafic/config.toml")) {
+		const stats = execSilent("stat -c '%a' /etc/trafic/config.toml");
+		const isSecure = stats === "640" || stats === "600";
+		checks.push({
+			name: "Config permissions",
+			status: isSecure ? "pass" : "warn",
+			message: isSecure ? "Config file has secure permissions" : `Config file permissions: ${stats} (should be 640)`,
+			fix: "Run: chmod 640 /etc/trafic/config.toml"
+		});
+	}
+	if (existsSync("/home/ddev/www")) {
+		const owner = execSilent("stat -c '%U:%G' /home/ddev/www");
+		const isCorrect = owner === "ddev:ddev";
+		checks.push({
+			name: "Projects directory",
+			status: isCorrect ? "pass" : "warn",
+			message: isCorrect ? "Projects directory owned by ddev" : `Projects directory owner: ${owner}`,
+			fix: "Run: chown ddev:ddev /home/ddev/www"
+		});
+	}
+	return checks;
+}
+/**
+* Run all audit checks
+*/
+function runAudit() {
+	return [
+		...auditSsh(),
+		...auditFirewall(),
+		...auditServices(),
+		...auditDocker(),
+		...auditPermissions()
+	];
+}
+/**
+* Print audit results
+*/
+function printAuditResults(checks) {
+	console.log("\n\x1B[1mSecurity Audit Results\x1B[0m\n");
+	for (const check of checks) {
+		const icon = check.status === "pass" ? "\x1B[32m✓\x1B[0m" : check.status === "warn" ? "\x1B[33m⚠\x1B[0m" : "\x1B[31m✗\x1B[0m";
+		console.log(`${icon} \x1b[1m${check.name}\x1b[0m: ${check.message}`);
+		if (check.fix && check.status !== "pass") console.log(`  \x1b[90m${check.fix}\x1b[0m`);
+	}
+	const passed = checks.filter((c) => c.status === "pass").length;
+	const warnings = checks.filter((c) => c.status === "warn").length;
+	const failed = checks.filter((c) => c.status === "fail").length;
+	console.log(`\n\x1b[1mSummary:\x1b[0m ${passed} passed, ${warnings} warnings, ${failed} failed`);
+}
+/**
+* Run the full server setup
+*/
+async function setup(options) {
+	resetSteps();
+	setDryRun(options.dryRun ?? false);
+	console.log("\n\x1B[1m🚦 Trafic Server Setup\x1B[0m\n");
+	if (options.dryRun) console.log("\x1B[33m⚠ Dry-run mode: no changes will be made\x1B[0m\n");
+	if (!isRoot() && !options.dryRun) {
+		error("This command must be run as root");
+		console.log("  Run: sudo trafic-agent setup ...");
+		process.exit(1);
+	}
+	info(`TLD: ${options.tld}`);
+	if (options.email) info(`Let's Encrypt email: ${options.email}`);
+	if (options.noHardening) info("Hardening: disabled");
+	try {
+		installSystemDeps();
+		createDdevUser();
+		if (!options.noDocker) {
+			installDocker();
+			configureDocker();
+			setupDockerPrune();
+		} else {
+			step("Install Docker");
+			info("Skipped (--no-docker)");
+		}
+		if (!options.noDdev) {
+			installDdev();
+			configureDdev(options.tld, options.email);
+			configureTraefik();
+		} else {
+			step("Install DDEV");
+			info("Skipped (--no-ddev)");
+		}
+		installNode();
+		installAgent();
+		createAgentConfig(options.tld, options.email);
+		createSystemdService();
+		if (!options.noHardening) hardenServer(options.sshUsers ?? ["ddev"]);
+		else {
+			step("Server hardening");
+			info("Skipped (--no-hardening)");
+		}
+		console.log("\n\x1B[32m✓ Setup complete!\x1B[0m\n");
+		console.log("Next steps:");
+		console.log(`  1. Edit /etc/trafic/config.toml to configure authentication`);
+		console.log(`  2. Add SSH public keys to /home/ddev/.ssh/authorized_keys`);
+		console.log(`  3. Deploy your first project:`);
+		console.log(`     npx @studiometa/trafic-cli deploy --host=<this-server> --name=my-app`);
+		console.log(`\nYour projects will be available at https://<name>.${options.tld}`);
+	} catch (err) {
+		error(`Setup failed: ${err instanceof Error ? err.message : err}`);
+		process.exit(1);
+	}
+}
+/**
+* Run security audit
+*/
+async function audit() {
+	const checks = runAudit();
+	printAuditResults(checks);
+	if (checks.filter((c) => c.status === "fail").length > 0) process.exit(1);
+}
+export { startIdleScheduler as a, parseDuration as c, runAudit as i, validateConfig as l, setup as n, stopIdleProjects as o, printAuditResults as r, loadConfig as s, audit as t };
+
+//# sourceMappingURL=setup-CVf8YfPW.js.map