@studiometa/trafic-agent 0.1.8 → 0.1.10

package/dist/index-CqtdZoAx.js

@@ -1,904 +0,0 @@
-import { o as loadProjectList, f as getIdleProjects, n as loadProjectConfig, v as shouldNeverStop, h as getIdleTimeoutMs, k as getProjectInfo, u as setProjectStatus, y as stopProject } from "./server-CHT47EXr.js";
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { parse } from "smol-toml";
-import { execSync } from "node:child_process";
-const DEFAULT_CONFIG_PATHS = [
-  "/etc/trafic/config.toml",
-  "./config.toml",
-  "./trafic.toml"
-];
-const DEFAULT_CONFIG = {
-  tld: "",
-  port: 9876,
-  dbPath: "/var/lib/trafic/db.sqlite",
-  projectListPath: "/home/ddev/.ddev/project_list.yaml",
-  projectsDir: "/home/ddev/www",
-  idleTimeout: "30m",
-  idleCheckInterval: "5m",
-  auth: {
-    defaultPolicy: "basic",
-    allowedIps: [],
-    tokens: [],
-    basicAuth: [],
-    rules: []
-  }
-};
-function parseDuration(duration) {
-  const regex = /(?:(\d+)h)?(?:(\d+)m)?(?:(\d+)s)?/;
-  const match = duration.match(regex);
-  if (!match) return 0;
-  const hours = parseInt(match[1] ?? "0", 10);
-  const minutes = parseInt(match[2] ?? "0", 10);
-  const seconds = parseInt(match[3] ?? "0", 10);
-  return (hours * 3600 + minutes * 60 + seconds) * 1e3;
-}
-function loadConfig(configPath) {
-  let path = configPath;
-  if (!path) {
-    path = DEFAULT_CONFIG_PATHS.find((p) => existsSync(p));
-  }
-  if (!path || !existsSync(path)) {
-    console.warn("No config file found, using defaults");
-    return DEFAULT_CONFIG;
-  }
-  const content = readFileSync(path, "utf-8");
-  const parsed = parse(content);
-  const auth = mergeAuthConfig(parsed.auth);
-  return {
-    tld: parsed.tld ?? DEFAULT_CONFIG.tld,
-    port: parsed.port ?? DEFAULT_CONFIG.port,
-    dbPath: parsed.db_path ?? DEFAULT_CONFIG.dbPath,
-    projectListPath: parsed.project_list_path ?? DEFAULT_CONFIG.projectListPath,
-    projectsDir: parsed.projects_dir ?? DEFAULT_CONFIG.projectsDir,
-    idleTimeout: parsed.idle_timeout ?? DEFAULT_CONFIG.idleTimeout,
-    idleCheckInterval: parsed.idle_check_interval ?? DEFAULT_CONFIG.idleCheckInterval,
-    auth
-  };
-}
-function mergeAuthConfig(raw) {
-  if (!raw) return DEFAULT_CONFIG.auth;
-  const rules = raw.rules ?? [];
-  return {
-    defaultPolicy: raw.default_policy ?? DEFAULT_CONFIG.auth.defaultPolicy,
-    allowedIps: raw.allowed_ips ?? DEFAULT_CONFIG.auth.allowedIps,
-    tokens: raw.tokens ?? DEFAULT_CONFIG.auth.tokens,
-    basicAuth: raw.basic_auth ?? DEFAULT_CONFIG.auth.basicAuth,
-    rules: rules.map(
-      (r) => ({
-        match: r.match,
-        policy: r.policy,
-        tokens: r.tokens,
-        allowedIps: r.allowed_ips
-      })
-    )
-  };
-}
-function validateConfig(config) {
-  const errors = [];
-  if (!config.tld) {
-    errors.push("tld is required");
-  }
-  if (config.port < 1 || config.port > 65535) {
-    errors.push("port must be between 1 and 65535");
-  }
-  if (config.auth.defaultPolicy !== "allow" && config.auth.defaultPolicy !== "deny" && config.auth.defaultPolicy !== "basic" && config.auth.defaultPolicy !== "token") {
-    errors.push('auth.default_policy must be "allow", "deny", "basic", or "token"');
-  }
-  return errors;
-}
-function stopIdleProjects(config) {
-  const globalThresholdMs = parseDuration(config.idleTimeout);
-  const projects = loadProjectList(config.projectListPath);
-  const idleProjects = getIdleProjects(globalThresholdMs);
-  for (const project of idleProjects) {
-    const projectDir = projects.get(project.name);
-    if (projectDir) {
-      const projectConfig = loadProjectConfig(projectDir);
-      if (shouldNeverStop(projectConfig)) {
-        continue;
-      }
-      const projectThresholdMs = getIdleTimeoutMs(projectConfig);
-      if (projectThresholdMs !== void 0) {
-        const idleDuration = Date.now() - project.lastAccess;
-        if (idleDuration < projectThresholdMs) {
-          continue;
-        }
-      }
-    }
-    const info2 = getProjectInfo(project.name);
-    if (info2?.status !== "running") {
-      setProjectStatus(project.name, "stopped");
-      continue;
-    }
-    console.log(`Stopping idle project: ${project.name}`);
-    const success2 = stopProject(project.name);
-    if (success2) {
-      setProjectStatus(project.name, "stopped");
-      console.log(`Stopped: ${project.name}`);
-    } else {
-      console.error(`Failed to stop: ${project.name}`);
-    }
-  }
-}
-function startIdleScheduler(config) {
-  const intervalMs = parseDuration(config.idleCheckInterval);
-  console.log(
-    `Idle scheduler started: checking every ${config.idleCheckInterval}, timeout ${config.idleTimeout}`
-  );
-  stopIdleProjects(config);
-  return setInterval(() => {
-    stopIdleProjects(config);
-  }, intervalMs);
-}
-let stepNumber = 0;
-let dryRun = false;
-function setDryRun(value) {
-  dryRun = value;
-}
-function resetSteps() {
-  stepNumber = 0;
-}
-function step(message) {
-  stepNumber++;
-  console.log(`
-\x1B[36m[${stepNumber}]\x1B[0m ${message}`);
-}
-function success(message) {
-  console.log(`    \x1B[32m✓\x1B[0m ${message}`);
-}
-function warn(message) {
-  console.log(`    \x1B[33m⚠\x1B[0m ${message}`);
-}
-function error(message) {
-  console.log(`    \x1B[31m✗\x1B[0m ${message}`);
-}
-function info(message) {
-  console.log(`    ${message}`);
-}
-function exec(command, options) {
-  if (dryRun) {
-    if (!options?.silent) {
-      console.log(`    \x1B[90m$ ${command}\x1B[0m`);
-    }
-    return "";
-  }
-  try {
-    return execSync(command, {
-      encoding: "utf-8",
-      stdio: options?.silent ? "pipe" : "inherit"
-    });
-  } catch (err) {
-    const e = err;
-    throw new Error(`Command failed: ${command}
-${e.stderr ?? ""}`);
-  }
-}
-function execSilent$1(command) {
-  if (dryRun) {
-    return "";
-  }
-  try {
-    return execSync(command, {
-      encoding: "utf-8",
-      stdio: "pipe"
-    }).trim();
-  } catch {
-    return "";
-  }
-}
-function commandExists(command) {
-  try {
-    execSync(`which ${command}`, { stdio: "pipe" });
-    return true;
-  } catch {
-    return false;
-  }
-}
-function isRoot() {
-  return process.getuid?.() === 0;
-}
-function createDdevUser() {
-  step("Create ddev user");
-  const userExists = execSilent$1("id -u ddev 2>/dev/null");
-  if (userExists) {
-    info("User 'ddev' already exists");
-  } else {
-    exec("useradd -m -s /bin/bash ddev");
-    success("Created user 'ddev'");
-  }
-  exec("usermod -aG docker ddev 2>/dev/null || true", { silent: true });
-  exec("mkdir -p /home/ddev/www");
-  exec("chown ddev:ddev /home/ddev/www");
-  exec("chmod 750 /home/ddev/www");
-  success("Created /home/ddev/www");
-  exec("mkdir -p /home/ddev/.ssh");
-  exec("chmod 700 /home/ddev/.ssh");
-  exec("chown ddev:ddev /home/ddev/.ssh");
-  success("User ddev configured (no sudo needed with proper DNS)");
-}
-function installDocker() {
-  step("Install Docker");
-  if (commandExists("docker")) {
-    const version = exec("docker --version", { silent: true });
-    info(`Docker already installed: ${version?.trim() ?? "unknown version"}`);
-    return;
-  }
-  info("Downloading Docker install script...");
-  exec("curl -fsSL https://get.docker.com -o /tmp/get-docker.sh");
-  exec("sh /tmp/get-docker.sh");
-  exec("rm /tmp/get-docker.sh");
-  exec("systemctl enable docker");
-  exec("systemctl start docker");
-  success("Docker installed and started");
-  exec("usermod -aG docker ddev");
-  success("Added ddev user to docker group");
-}
-function configureDocker() {
-  step("Configure Docker");
-  const daemonConfig = {
-    "log-driver": "json-file",
-    "log-opts": {
-      "max-size": "10m",
-      "max-file": "3"
-    },
-    "storage-driver": "overlay2",
-    "live-restore": true
-  };
-  exec("mkdir -p /etc/docker");
-  const configPath = "/etc/docker/daemon.json";
-  if (existsSync(configPath)) {
-    try {
-      const existing = JSON.parse(readFileSync(configPath, "utf-8"));
-      const merged = { ...existing, ...daemonConfig };
-      writeFileSync(configPath, JSON.stringify(merged, null, 2));
-      info("Merged with existing Docker config");
-    } catch {
-      warn("Could not parse existing Docker config, skipping");
-      return;
-    }
-  } else {
-    writeFileSync(configPath, JSON.stringify(daemonConfig, null, 2));
-  }
-  exec("systemctl reload docker || systemctl restart docker");
-  success("Docker configured with production settings");
-}
-function setupDockerPrune() {
-  step("Setup Docker cleanup cron");
-  const cronContent = `# Trafic: Clean up Docker resources weekly
-0 3 * * 0 root docker system prune -af --volumes 2>&1 | logger -t docker-prune
-`;
-  writeFileSync("/etc/cron.d/trafic-docker-prune", cronContent);
-  exec("chmod 644 /etc/cron.d/trafic-docker-prune");
-  success("Docker prune scheduled weekly at 3am on Sundays");
-}
-function installSystemDeps() {
-  step("Install system dependencies");
-  exec("apt-get update -qq", { silent: true });
-  exec("DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y jq curl rsync", { silent: true });
-  success("System dependencies installed: jq, curl, rsync");
-}
-function installDdev() {
-  step("Install DDEV");
-  if (commandExists("ddev")) {
-    const version = exec("ddev --version 2>/dev/null | head -1", { silent: true });
-    info(`DDEV already installed: ${version?.trim() ?? "unknown version"}`);
-    return;
-  }
-  info("Fetching latest DDEV version...");
-  const latestVersion = exec(
-    `curl -fsSL https://api.github.com/repos/ddev/ddev/releases/latest | grep '"tag_name"' | sed -E 's/.*"([^"]+)".*/\\1/'`,
-    { silent: true }
-  )?.trim();
-  if (!latestVersion) {
-    throw new Error("Could not determine latest DDEV version");
-  }
-  info(`Installing DDEV ${latestVersion}...`);
-  const arch = exec("uname -m", { silent: true })?.trim() === "x86_64" ? "amd64" : "arm64";
-  const tarball = `ddev_linux-${arch}.${latestVersion}.tar.gz`;
-  const url = `https://github.com/ddev/ddev/releases/download/${latestVersion}/${tarball}`;
-  exec(`curl -fsSL -o /tmp/${tarball} ${url}`);
-  exec(`tar -xzf /tmp/${tarball} -C /tmp ddev`);
-  exec("mv /tmp/ddev /usr/local/bin/ddev");
-  exec("chmod +x /usr/local/bin/ddev");
-  exec(`rm -f /tmp/${tarball}`);
-  info("Installing mkcert...");
-  const mkcertVersion = exec(
-    `curl -fsSL https://api.github.com/repos/FiloSottile/mkcert/releases/latest | grep '"tag_name"' | sed -E 's/.*"([^"]+)".*/\\1/'`,
-    { silent: true }
-  )?.trim();
-  if (mkcertVersion) {
-    const mkcertBin = `mkcert-${mkcertVersion}-linux-${arch}`;
-    exec(`curl -fsSL -o /usr/local/bin/mkcert https://github.com/FiloSottile/mkcert/releases/download/${mkcertVersion}/${mkcertBin}`);
-    exec("chmod +x /usr/local/bin/mkcert");
-  }
-  success(`DDEV ${latestVersion} installed`);
-}
-function configureDdev(tld, email) {
-  step("Configure DDEV");
-  const ddevCmd = (cmd) => `su - ddev -c '${cmd}'`;
-  exec(
-    ddevCmd(
-      `ddev config global --project-tld=${tld} --router-http-port=80 --router-https-port=443 --use-letsencrypt=${email ? "true" : "false"} ${email ? `--letsencrypt-email=${email}` : ""}`
-    )
-  );
-  success(`DDEV configured with TLD: ${tld}`);
-  info(`Ensure DNS is configured: *.${tld} → server IP`);
-  if (email) {
-    success(`Let's Encrypt enabled with email: ${email}`);
-  }
-  exec(ddevCmd("ddev config global --instrumentation-opt-in=false"));
-  success("DDEV global settings configured");
-}
-function configureTraefik() {
-  step("Configure Traefik for forward auth");
-  exec("mkdir -p /home/ddev/.ddev/traefik");
-  exec("chown -R ddev:ddev /home/ddev/.ddev");
-  const staticConfig = `# Trafic: Forward auth middleware
-http:
-  middlewares:
-    trafic-auth:
-      forwardAuth:
-        address: "http://host.docker.internal:9876/__auth__"
-        authResponseHeaders:
-          - "X-Trafic-Project"
-
-    trafic-errors:
-      errors:
-        status:
-          - "502"
-          - "503"
-        service: trafic-service
-        query: "/"
-
-  services:
-    trafic-service:
-      loadBalancer:
-        servers:
-          - url: "http://host.docker.internal:9876"
-`;
-  writeFileSync("/home/ddev/.ddev/traefik/trafic.yaml", staticConfig);
-  exec("chown ddev:ddev /home/ddev/.ddev/traefik/trafic.yaml");
-  const routerConfig = `# Trafic: Default router configuration
-# This file makes all DDEV projects use the Trafic auth middleware
-http:
-  routers:
-    trafic-catch-all:
-      rule: "HostRegexp(\`.+\`)"
-      priority: 1
-      middlewares:
-        - trafic-auth
-        - trafic-errors
-      service: api@internal
-`;
-  writeFileSync("/home/ddev/.ddev/traefik/dynamic.yaml", routerConfig);
-  exec("chown ddev:ddev /home/ddev/.ddev/traefik/dynamic.yaml");
-  success("Traefik configured with Trafic middleware");
-}
-function installNode() {
-  step("Install Node.js");
-  if (commandExists("node")) {
-    const version = exec("node --version", { silent: true });
-    info(`Node.js already installed: ${version?.trim()}`);
-    return;
-  }
-  exec(
-    'curl -fsSL https://fnm.vercel.app/install | bash -s -- --install-dir "/opt/fnm" --skip-shell'
-  );
-  const profileContent = `# Trafic: fnm (Node.js version manager)
-export FNM_DIR="/opt/fnm"
-export PATH="/opt/fnm:$PATH"
-eval "$(fnm env)"
-`;
-  writeFileSync("/etc/profile.d/fnm.sh", profileContent);
-  exec("chmod 644 /etc/profile.d/fnm.sh");
-  exec("export FNM_DIR=/opt/fnm && /opt/fnm/fnm install 24");
-  exec("export FNM_DIR=/opt/fnm && /opt/fnm/fnm default 24");
-  exec(
-    "ln -sf /opt/fnm/aliases/default/bin/node /usr/local/bin/node || true"
-  );
-  exec("ln -sf /opt/fnm/aliases/default/bin/npm /usr/local/bin/npm || true");
-  exec("ln -sf /opt/fnm/aliases/default/bin/npx /usr/local/bin/npx || true");
-  success("Node.js 24 installed via fnm");
-}
-function installAgent() {
-  step("Install Trafic agent");
-  exec("npm install -g @studiometa/trafic-agent");
-  success("Trafic agent installed");
-}
-function createAgentConfig(tld, _email) {
-  step("Create agent configuration");
-  exec("mkdir -p /etc/trafic");
-  exec("mkdir -p /var/lib/trafic");
-  exec("chown ddev:ddev /var/lib/trafic");
-  const configPath = "/etc/trafic/config.toml";
-  if (existsSync(configPath)) {
-    info("Configuration already exists at /etc/trafic/config.toml — skipping");
-    info("Edit this file to configure authentication");
-    return;
-  }
-  const config = `# Trafic agent configuration
-# Generated by trafic setup
-
-# Required: TLD for DDEV projects
-tld = "${tld}"
-
-# Agent HTTP server port
-port = 9876
-
-# Database and paths
-db_path = "/var/lib/trafic/db.sqlite"
-project_list_path = "/home/ddev/.ddev/project_list.yaml"
-projects_dir = "/home/ddev/www"
-
-# Scale-to-zero settings
-idle_timeout = "4h"
-idle_check_interval = "5m"
-
-# Authentication
-[auth]
-default_policy = "basic"
-allowed_ips = []
-tokens = []
-basic_auth = []
-rules = []
-`;
-  writeFileSync(configPath, config);
-  exec("chmod 640 /etc/trafic/config.toml");
-  exec("chown root:ddev /etc/trafic/config.toml");
-  success("Configuration created at /etc/trafic/config.toml");
-  info("Edit this file to configure authentication");
-}
-function createSystemdService() {
-  step("Create systemd service");
-  const agentPath = exec("which trafic-agent", { silent: true })?.trim() || "/usr/bin/trafic-agent";
-  const serviceContent = `[Unit]
-Description=Trafic Agent - DDEV preview environment manager
-After=network.target docker.service
-Requires=docker.service
-
-[Service]
-Type=simple
-User=ddev
-Group=ddev
-ExecStart=${agentPath} start --config /etc/trafic/config.toml
-Restart=always
-RestartSec=5
-StandardOutput=journal
-StandardError=journal
-SyslogIdentifier=trafic-agent
-
-# Environment
-Environment=NODE_ENV=production
-# Skip ddev-hostname /etc/hosts management — on a server, hostnames resolve
-# to the public IP (not localhost), which would trigger ddev-hostname on every
-# ddev start. DDEV_NONINTERACTIVE=true skips that entirely.
-Environment=DDEV_NONINTERACTIVE=true
-
-# Security hardening
-NoNewPrivileges=true
-ProtectSystem=strict
-ProtectHome=read-only
-ReadWritePaths=/var/lib/trafic /home/ddev/.ddev
-PrivateTmp=true
-
-[Install]
-WantedBy=multi-user.target
-`;
-  writeFileSync("/etc/systemd/system/trafic-agent.service", serviceContent);
-  exec("chmod 644 /etc/systemd/system/trafic-agent.service");
-  exec("systemctl daemon-reload");
-  exec("systemctl enable trafic-agent");
-  exec("systemctl start trafic-agent");
-  success("Trafic agent service started");
-  info("View logs: journalctl -u trafic-agent -f");
-}
-function hardenSsh(allowedUsers = ["ddev"]) {
-  step("Harden SSH configuration");
-  const sshConfig = `# Trafic SSH hardening
-# Generated by trafic setup
-
-# Allow root login via SSH key only (no password) — required for server management
-PermitRootLogin prohibit-password
-
-# Disable password authentication (keys only)
-PasswordAuthentication no
-PubkeyAuthentication yes
-
-# Limit authentication attempts
-MaxAuthTries 3
-
-# Idle timeout (5 minutes)
-ClientAliveInterval 300
-ClientAliveCountMax 2
-
-# Allowed users (root kept for emergency access)
-AllowUsers root ${allowedUsers.join(" ")}
-
-# Disable X11 forwarding
-X11Forwarding no
-
-# Disable TCP forwarding
-AllowTcpForwarding no
-
-# Use strong algorithms only
-KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
-Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com
-MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
-`;
-  writeFileSync("/etc/ssh/sshd_config.d/trafic.conf", sshConfig);
-  exec("chmod 644 /etc/ssh/sshd_config.d/trafic.conf");
-  const testResult = exec("sshd -t 2>&1 || echo 'error'", { silent: true });
-  if (testResult?.includes("error")) {
-    warn("SSH config test failed, reverting...");
-    exec("rm /etc/ssh/sshd_config.d/trafic.conf");
-    return;
-  }
-  exec("systemctl reload ssh || systemctl reload sshd");
-  success("SSH hardened: password auth disabled, root key-only login retained");
-  info(`Allowed users: root, ${allowedUsers.join(", ")}`);
-}
-function configureFirewall() {
-  step("Configure firewall (UFW)");
-  if (!commandExists("ufw")) {
-    exec("DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y ufw", { silent: true });
-  }
-  exec("ufw --force reset", { silent: true });
-  exec("ufw default deny incoming");
-  exec("ufw default allow outgoing");
-  exec("ufw allow 22/tcp comment 'SSH'");
-  exec("ufw allow 80/tcp comment 'HTTP'");
-  exec("ufw allow 443/tcp comment 'HTTPS'");
-  exec("ufw --force enable");
-  success("Firewall enabled: SSH (22), HTTP (80), HTTPS (443) allowed");
-}
-function configureUnattendedUpgrades() {
-  step("Configure automatic security updates");
-  exec(
-    "DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y unattended-upgrades apt-listchanges",
-    { silent: true }
-  );
-  const upgradesConfig = `// Trafic: Automatic security updates
-Unattended-Upgrade::Allowed-Origins {
-    "\${distro_id}:\${distro_codename}";
-    "\${distro_id}:\${distro_codename}-security";
-    "\${distro_id}ESMApps:\${distro_codename}-apps-security";
-    "\${distro_id}ESM:\${distro_codename}-infra-security";
-};
-
-// Do not automatically reboot
-Unattended-Upgrade::Automatic-Reboot "false";
-
-// Remove unused dependencies
-Unattended-Upgrade::Remove-Unused-Dependencies "true";
-
-// Email notifications (optional)
-// Unattended-Upgrade::Mail "root";
-`;
-  writeFileSync(
-    "/etc/apt/apt.conf.d/50unattended-upgrades",
-    upgradesConfig
-  );
-  const autoConfig = `APT::Periodic::Update-Package-Lists "1";
-APT::Periodic::Download-Upgradeable-Packages "1";
-APT::Periodic::AutocleanInterval "7";
-APT::Periodic::Unattended-Upgrade "1";
-`;
-  writeFileSync("/etc/apt/apt.conf.d/20auto-upgrades", autoConfig);
-  exec("systemctl enable unattended-upgrades");
-  exec("systemctl start unattended-upgrades");
-  success("Automatic security updates enabled");
-}
-function configureFail2ban() {
-  step("Configure Fail2ban");
-  if (!commandExists("fail2ban-client")) {
-    exec("DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y fail2ban", { silent: true });
-  }
-  const jailConfig = `# Trafic: Fail2ban configuration
-[DEFAULT]
-bantime = 3600
-findtime = 600
-maxretry = 5
-backend = auto
-
-[sshd]
-enabled = true
-port = ssh
-filter = sshd
-logpath = /var/log/auth.log
-maxretry = 3
-bantime = 7200
-`;
-  writeFileSync("/etc/fail2ban/jail.local", jailConfig);
-  exec("chmod 644 /etc/fail2ban/jail.local");
-  exec("systemctl enable fail2ban");
-  exec("systemctl restart fail2ban");
-  success("Fail2ban enabled: SSH brute force protection active");
-}
-function configureSystemLimits() {
-  step("Configure system limits");
-  const limitsConfig = `# Trafic: System limits for ddev user
-ddev soft nofile 65536
-ddev hard nofile 65536
-ddev soft nproc 4096
-ddev hard nproc 4096
-`;
-  writeFileSync("/etc/security/limits.d/trafic.conf", limitsConfig);
-  exec("chmod 644 /etc/security/limits.d/trafic.conf");
-  success("System limits configured for ddev user");
-}
-function configureFilePermissions() {
-  step("Configure file permissions");
-  exec("mkdir -p /etc/trafic");
-  exec("mkdir -p /var/lib/trafic");
-  exec("mkdir -p /var/backups/trafic");
-  exec("chmod 755 /etc/trafic");
-  exec("chmod 700 /var/lib/trafic");
-  exec("chmod 700 /var/backups/trafic");
-  exec("chown root:ddev /etc/trafic");
-  exec("chown ddev:ddev /var/lib/trafic");
-  exec("chown ddev:ddev /var/backups/trafic");
-  if (existsSync("/etc/trafic/config.toml")) {
-    exec("chmod 640 /etc/trafic/config.toml");
-    exec("chown root:ddev /etc/trafic/config.toml");
-  }
-  success("File permissions configured");
-}
-function hardenServer(sshUsers = ["ddev"]) {
-  hardenSsh(sshUsers);
-  configureFirewall();
-  configureUnattendedUpgrades();
-  configureFail2ban();
-  configureSystemLimits();
-  configureFilePermissions();
-}
-function execSilent(command) {
-  try {
-    return execSync(command, { encoding: "utf-8", stdio: "pipe" }).trim();
-  } catch {
-    return "";
-  }
-}
-function isServiceActive(service) {
-  const status = execSilent(`systemctl is-active ${service}`);
-  return status === "active";
-}
-function auditSsh() {
-  const checks = [];
-  const sshdConfig = existsSync("/etc/ssh/sshd_config") ? readFileSync("/etc/ssh/sshd_config", "utf-8") : "";
-  const traficConfig = existsSync("/etc/ssh/sshd_config.d/trafic.conf") ? readFileSync("/etc/ssh/sshd_config.d/trafic.conf", "utf-8") : "";
-  const config = sshdConfig + "\n" + traficConfig;
-  const rootLoginDisabled = config.includes("PermitRootLogin no") || config.includes("PermitRootLogin prohibit-password");
-  checks.push({
-    name: "SSH root login",
-    status: rootLoginDisabled ? "pass" : "fail",
-    message: rootLoginDisabled ? "Root login disabled" : "Root login may be enabled",
-    fix: "Add 'PermitRootLogin no' to /etc/ssh/sshd_config.d/trafic.conf"
-  });
-  const passwordAuthDisabled = config.includes("PasswordAuthentication no");
-  checks.push({
-    name: "SSH password auth",
-    status: passwordAuthDisabled ? "pass" : "warn",
-    message: passwordAuthDisabled ? "Password authentication disabled" : "Password authentication may be enabled",
-    fix: "Add 'PasswordAuthentication no' to /etc/ssh/sshd_config.d/trafic.conf"
-  });
-  return checks;
-}
-function auditFirewall() {
-  const checks = [];
-  const ufwStatus = execSilent("ufw status");
-  const isActive = ufwStatus.includes("Status: active");
-  checks.push({
-    name: "Firewall (UFW)",
-    status: isActive ? "pass" : "fail",
-    message: isActive ? "UFW is active" : "UFW is not active",
-    fix: "Run: ufw enable"
-  });
-  if (isActive) {
-    const allows22 = ufwStatus.includes("22/tcp");
-    const allows80 = ufwStatus.includes("80/tcp");
-    const allows443 = ufwStatus.includes("443/tcp");
-    if (allows22 && allows80 && allows443) {
-      checks.push({
-        name: "Firewall ports",
-        status: "pass",
-        message: "Required ports (22, 80, 443) are open"
-      });
-    } else {
-      checks.push({
-        name: "Firewall ports",
-        status: "warn",
-        message: "Some required ports may be blocked",
-        fix: "Run: ufw allow 22/tcp && ufw allow 80/tcp && ufw allow 443/tcp"
-      });
-    }
-  }
-  return checks;
-}
-function auditServices() {
-  const checks = [];
-  const fail2banActive = isServiceActive("fail2ban");
-  checks.push({
-    name: "Fail2ban",
-    status: fail2banActive ? "pass" : "warn",
-    message: fail2banActive ? "Fail2ban is active" : "Fail2ban is not running",
-    fix: "Run: apt install fail2ban && systemctl enable fail2ban --now"
-  });
-  const unattendedActive = isServiceActive("unattended-upgrades");
-  checks.push({
-    name: "Automatic updates",
-    status: unattendedActive ? "pass" : "warn",
-    message: unattendedActive ? "Unattended upgrades enabled" : "Automatic updates not configured",
-    fix: "Run: apt install unattended-upgrades && dpkg-reconfigure unattended-upgrades"
-  });
-  const agentActive = isServiceActive("trafic-agent");
-  checks.push({
-    name: "Trafic agent",
-    status: agentActive ? "pass" : "fail",
-    message: agentActive ? "Trafic agent is running" : "Trafic agent is not running",
-    fix: "Run: systemctl start trafic-agent"
-  });
-  return checks;
-}
-function auditDocker() {
-  const checks = [];
-  const dockerActive = isServiceActive("docker");
-  checks.push({
-    name: "Docker",
-    status: dockerActive ? "pass" : "fail",
-    message: dockerActive ? "Docker is running" : "Docker is not running",
-    fix: "Run: systemctl start docker"
-  });
-  const danglingImages = execSilent(
-    "docker images -f dangling=true -q | wc -l"
-  );
-  const count = parseInt(danglingImages, 10) || 0;
-  if (count > 0) {
-    checks.push({
-      name: "Docker cleanup",
-      status: "warn",
-      message: `${count} dangling Docker images`,
-      fix: "Run: docker system prune -f"
-    });
-  }
-  const diskUsage = execSilent("df -h / | awk 'NR==2{print $5}'");
-  const usagePercent = parseInt(diskUsage, 10) || 0;
-  checks.push({
-    name: "Disk usage",
-    status: usagePercent > 90 ? "fail" : usagePercent > 80 ? "warn" : "pass",
-    message: `Disk usage: ${diskUsage}`,
-    fix: usagePercent > 80 ? "Consider cleaning up old projects or Docker resources" : void 0
-  });
-  return checks;
-}
-function auditPermissions() {
-  const checks = [];
-  if (existsSync("/etc/trafic/config.toml")) {
-    const stats = execSilent("stat -c '%a' /etc/trafic/config.toml");
-    const isSecure = stats === "640" || stats === "600";
-    checks.push({
-      name: "Config permissions",
-      status: isSecure ? "pass" : "warn",
-      message: isSecure ? "Config file has secure permissions" : `Config file permissions: ${stats} (should be 640)`,
-      fix: "Run: chmod 640 /etc/trafic/config.toml"
-    });
-  }
-  if (existsSync("/home/ddev/www")) {
-    const owner = execSilent("stat -c '%U:%G' /home/ddev/www");
-    const isCorrect = owner === "ddev:ddev";
-    checks.push({
-      name: "Projects directory",
-      status: isCorrect ? "pass" : "warn",
-      message: isCorrect ? "Projects directory owned by ddev" : `Projects directory owner: ${owner}`,
-      fix: "Run: chown ddev:ddev /home/ddev/www"
-    });
-  }
-  return checks;
-}
-function runAudit() {
-  return [
-    ...auditSsh(),
-    ...auditFirewall(),
-    ...auditServices(),
-    ...auditDocker(),
-    ...auditPermissions()
-  ];
-}
-function printAuditResults(checks) {
-  console.log("\n\x1B[1mSecurity Audit Results\x1B[0m\n");
-  for (const check of checks) {
-    const icon = check.status === "pass" ? "\x1B[32m✓\x1B[0m" : check.status === "warn" ? "\x1B[33m⚠\x1B[0m" : "\x1B[31m✗\x1B[0m";
-    console.log(`${icon} \x1B[1m${check.name}\x1B[0m: ${check.message}`);
-    if (check.fix && check.status !== "pass") {
-      console.log(`  \x1B[90m${check.fix}\x1B[0m`);
-    }
-  }
-  const passed = checks.filter((c) => c.status === "pass").length;
-  const warnings = checks.filter((c) => c.status === "warn").length;
-  const failed = checks.filter((c) => c.status === "fail").length;
-  console.log(
-    `
-\x1B[1mSummary:\x1B[0m ${passed} passed, ${warnings} warnings, ${failed} failed`
-  );
-}
-async function setup(options) {
-  resetSteps();
-  setDryRun(options.dryRun ?? false);
-  console.log("\n\x1B[1m🚦 Trafic Server Setup\x1B[0m\n");
-  if (options.dryRun) {
-    console.log("\x1B[33m⚠ Dry-run mode: no changes will be made\x1B[0m\n");
-  }
-  if (!isRoot() && !options.dryRun) {
-    error("This command must be run as root");
-    console.log("  Run: sudo trafic-agent setup ...");
-    process.exit(1);
-  }
-  info(`TLD: ${options.tld}`);
-  if (options.email) {
-    info(`Let's Encrypt email: ${options.email}`);
-  }
-  if (options.noHardening) {
-    info("Hardening: disabled");
-  }
-  try {
-    installSystemDeps();
-    createDdevUser();
-    if (!options.noDocker) {
-      installDocker();
-      configureDocker();
-      setupDockerPrune();
-    } else {
-      step("Install Docker");
-      info("Skipped (--no-docker)");
-    }
-    if (!options.noDdev) {
-      installDdev();
-      configureDdev(options.tld, options.email);
-      configureTraefik();
-    } else {
-      step("Install DDEV");
-      info("Skipped (--no-ddev)");
-    }
-    installNode();
-    installAgent();
-    createAgentConfig(options.tld, options.email);
-    createSystemdService();
-    if (!options.noHardening) {
-      const sshUsers = options.sshUsers ?? ["ddev"];
-      hardenServer(sshUsers);
-    } else {
-      step("Server hardening");
-      info("Skipped (--no-hardening)");
-    }
-    console.log("\n\x1B[32m✓ Setup complete!\x1B[0m\n");
-    console.log("Next steps:");
-    console.log(`  1. Edit /etc/trafic/config.toml to configure authentication`);
-    console.log(`  2. Add SSH public keys to /home/ddev/.ssh/authorized_keys`);
-    console.log(`  3. Deploy your first project:`);
-    console.log(`     npx @studiometa/trafic-cli deploy --host=<this-server> --name=my-app`);
-    console.log(`
-Your projects will be available at https://<name>.${options.tld}`);
-  } catch (err) {
-    error(`Setup failed: ${err instanceof Error ? err.message : err}`);
-    process.exit(1);
-  }
-}
-async function audit() {
-  const checks = runAudit();
-  printAuditResults(checks);
-  const failed = checks.filter((c) => c.status === "fail").length;
-  if (failed > 0) {
-    process.exit(1);
-  }
-}
-export {
-  audit as a,
-  printAuditResults as b,
-  startIdleScheduler as c,
-  stopIdleProjects as d,
-  loadConfig as l,
-  parseDuration as p,
-  runAudit as r,
-  setup as s,
-  validateConfig as v
-};
-//# sourceMappingURL=index-CqtdZoAx.js.map