@wpelevator/tug 0.8.0 → 0.10.0

package/dist/cli-config.js

@@ -8,7 +8,18 @@ import { errMessage } from "./util.js";
 export const COMMAND_SETTINGS = {
     file: { type: 'path', flag: '--file', commands: ['deploy'] },
     buildLocal: { type: 'boolean', flag: '--build-local', commands: ['deploy'] },
-    wait: { type: 'boolean', flag: '--no-wait', commands: ['deploy', 'rollback'] },
+    wait: {
+        type: 'boolean',
+        flag: '--no-wait',
+        commands: [
+            'deploy',
+            'rollback',
+            'backup-run',
+            'node-install',
+            'node-replace-identity',
+            'node-repair-identity',
+        ],
+    },
 };
 /** Per-node connection data (`nodes.<name>`); `nodeDefaults` takes the subset that is not node-specific. */
 export const NODE_SETTINGS = {
@@ -17,32 +28,28 @@ export const NODE_SETTINGS = {
         flag: '<ssh-target>',
         commands: ['node-install', 'node-replace-identity', 'node-repair-identity'],
     },
-    address: { type: 'string', flag: '--address', commands: ['node-install', 'node-register'] },
-    publicAddress: {
+    address: {
         type: 'string',
-        flag: '--public-address',
-        commands: ['node-install', 'node-register'],
+        flag: '--address',
+        commands: [
+            'node-install',
+            'node-replace-identity',
+            'node-repair-identity',
+            'node-register',
+            'node-prepare-enrollment',
+        ],
     },
     label: {
         type: 'list',
         flag: '--label',
-        commands: ['node-install', 'node-register', 'node-prepare-enrollment'],
-    },
-    mesh: {
-        type: 'boolean',
-        flag: '--mesh',
         commands: [
             'node-install',
             'node-replace-identity',
             'node-repair-identity',
+            'node-register',
             'node-prepare-enrollment',
         ],
     },
-    wgPort: {
-        type: 'port',
-        flag: '--wg-port',
-        commands: ['node-install', 'node-replace-identity', 'node-repair-identity'],
-    },
     installDocker: {
         type: 'boolean',
         flag: '--install-docker',
@@ -51,6 +58,7 @@ export const NODE_SETTINGS = {
             'node-replace-identity',
             'node-repair-identity',
             'node-prepare-enrollment',
+            'control-install',
         ],
     },
     image: {
@@ -61,6 +69,7 @@ export const NODE_SETTINGS = {
             'node-replace-identity',
             'node-repair-identity',
             'node-prepare-enrollment',
+            'control-install',
         ],
     },
     agentControlUrl: {
@@ -74,7 +83,7 @@ export const NODE_SETTINGS = {
         ],
     },
 };
-const NODE_SPECIFIC_KEYS = ['ssh', 'address', 'publicAddress'];
+const NODE_SPECIFIC_KEYS = ['ssh', 'address'];
 const SETTINGS = { ...COMMAND_SETTINGS, ...NODE_SETTINGS };
 /** Default file names, in lookup order; more than one present is an error. */
 export const CONFIG_NAMES = ['tug.yml', 'tug.yaml', 'tug.json', '.tug.json'];
@@ -118,16 +127,14 @@ export async function resolveCliConfig(options, env, cwd, creating = false) {
             if (!creating)
                 throw new Error(`cannot use credential ${credentialFile ?? 'from TUG_CREDENTIAL'}: ${errMessage(e)}`, { cause: e });
         }
-    const controlUrl = options.controlUrl ||
-        env.TUG_CONTROL_URL ||
-        config.controlUrl ||
-        credential?.url ||
-        'https://localhost:8443';
+    const requestedControlUrl = options.controlUrl || env.TUG_CONTROL_URL || config.controlUrl;
+    const controlUrl = requestedControlUrl || credential?.url || 'https://localhost:8443';
     return {
         file,
         fileExists: Boolean(base),
         localFile,
         controlUrl: normalizeControlUrl(controlUrl),
+        requestedControlUrl: requestedControlUrl ? normalizeControlUrl(requestedControlUrl) : undefined,
         credential,
         credentialFile,
         project: options.project || env.TUG_PROJECT || config.project || 'site',
@@ -214,8 +221,6 @@ function settingValue(setting, value, where, dir) {
             if (typeof value !== 'boolean')
                 throw new Error(`${where} must be true or false`);
             return value;
-        case 'port':
-            return String(integerOption(String(value), where, 1, 65535));
         case 'list':
             return (Array.isArray(value) ? value : [value]).map((item, index) => text(item, Array.isArray(value) ? `${where}[${index}]` : where));
     }

package/dist/cli-install.d.ts

@@ -1,17 +1,20 @@
 /** The agent dials container IPs for health checks; from the default bridge they are unreachable on current Docker (29.x), so it always shares the host network namespace. */
 export declare const HOST_NETWORK_FLAG = "--network host";
-export declare const MESH_RUN_FLAGS = "--network host --cap-add NET_ADMIN";
 /** Docker platform for the architecture a host reports with `uname -m`. */
 export declare function dockerPlatform(uname: string): string;
 /** Build for the host the image will run on, not the machine that builds it (an arm64 laptop and an amd64 VPS differ). */
 export declare function localImageBuildArgs(imageTag: string, uname: string): string[];
 export declare function shellQuote(value: unknown): string;
-export declare function dockerRunSnippet(image: string, joinKey: string, mesh?: boolean): string;
+export declare function dockerRunSnippet(image: string, joinKey: string, address?: string): string;
 /** The bootstrap runs in its own shell so its idempotent early exit cannot skip enrollment. */
 export declare function enrollmentCloudInit(bootstrap: string, command: string): string;
 /** Name of the container `control-install` creates (Compose project `tug-control`, service `control`). */
 export declare const CONTROL_CONTAINER = "tug-control-control-1";
 /** A TCP port is free, or is held by the control container this install would replace, so installing again upgrades in place. */
 export declare function controlPortCheck(port: number): string;
-/** An occupied mesh port is reusable only when the installed Tug agent owns the live key. */
-export declare function meshPortCheck(port: number): string;
+/**
+ * The default control URL for `control-install`: the SSH target's host and the published port. Accepts
+ * `host`, `user@host`, `ssh://user@host:2222` and bracketed IPv6. An SSH alias from ~/.ssh/config is used as written,
+ * so pass `--control-url` when the alias is not a name or address clients can reach.
+ */
+export declare function defaultControlUrl(sshTarget: string, port: number | string): string;

package/dist/cli-install.js

@@ -1,7 +1,6 @@
 import * as yaml from 'js-yaml';
 /** The agent dials container IPs for health checks; from the default bridge they are unreachable on current Docker (29.x), so it always shares the host network namespace. */
 export const HOST_NETWORK_FLAG = '--network host';
-export const MESH_RUN_FLAGS = `${HOST_NETWORK_FLAG} --cap-add NET_ADMIN`;
 /** Docker platform for the architecture a host reports with `uname -m`. */
 export function dockerPlatform(uname) {
     const arch = uname.trim();
@@ -18,8 +17,8 @@ export function localImageBuildArgs(imageTag, uname) {
 export function shellQuote(value) {
     return `'${String(value).replace(/'/g, `'\\''`)}'`;
 }
-export function dockerRunSnippet(image, joinKey, mesh = false) {
-    return `docker run -d --name tug-agent --restart unless-stopped ${mesh ? `${MESH_RUN_FLAGS} -e TUG_MESH=true ` : `${HOST_NETWORK_FLAG} `}-v /var/run/docker.sock:/var/run/docker.sock -v tug-agent:/var/lib/tug -e TUG_JOIN_KEY=${shellQuote(joinKey)} ${shellQuote(image)} agent`;
+export function dockerRunSnippet(image, joinKey, address) {
+    return `docker run -d --name tug-agent --restart unless-stopped ${HOST_NETWORK_FLAG} -v /var/run/docker.sock:/var/run/docker.sock -v tug-agent:/var/lib/tug -e TUG_JOIN_KEY=${shellQuote(joinKey)} ${address ? `-e TUG_NODE_ADDRESS=${shellQuote(address)} ` : ''}${shellQuote(image)} agent`;
 }
 /** The bootstrap runs in its own shell so its idempotent early exit cannot skip enrollment. */
 export function enrollmentCloudInit(bootstrap, command) {
@@ -42,24 +41,23 @@ ss -ltn | awk '{print $4}' | grep -qE '[.:]${port}$' || exit 0
 [ -n "$(docker ps -q --filter 'name=^/${CONTROL_CONTAINER}$' --filter 'publish=${port}' 2>/dev/null)" ]
 `;
 }
-/** An occupied mesh port is reusable only when the installed Tug agent owns the live key. */
-export function meshPortCheck(port) {
-    if (!Number.isInteger(port) || port < 1 || port > 65535)
-        throw new Error('mesh port must be an integer from 1 to 65535');
-    return `command -v ss >/dev/null 2>&1 || exit 1
-listeners=$(ss -lun) || exit 1
-if ! printf '%s\\n' "$listeners" | awk '{print $4}' | grep -qE '[.:]${port}$'; then exit 0; fi
-[ "$(docker inspect --format '{{.HostConfig.NetworkMode}}' tug-agent 2>/dev/null)" = host ] || exit 1
-[ "$(docker inspect --format '{{.State.Running}}' tug-agent 2>/dev/null)" = true ] || exit 1
-docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' tug-agent 2>/dev/null | grep -qx 'TUG_MESH=true' || exit 1
-[ "$(docker inspect --format '{{range .Mounts}}{{if eq .Destination "/var/lib/tug"}}{{.Source}}{{end}}{{end}}' tug-agent 2>/dev/null)" = /var/lib/tug ] || exit 1
-docker exec tug-agent sh -eu -c ${shellQuote(`
-test -s /var/lib/tug/wireguard/private.key
-test -s /var/lib/tug/wireguard/reported.pub
-test "$(wg show wg0 listen-port)" = "${port}"
-live_key=$(wg show wg0 public-key)
-test -n "$live_key"
-test "$live_key" = "$(wg pubkey < /var/lib/tug/wireguard/private.key)"
-test "$live_key" = "$(cat /var/lib/tug/wireguard/reported.pub)"`)}
-`;
+/**
+ * The default control URL for `control-install`: the SSH target's host and the published port. Accepts
+ * `host`, `user@host`, `ssh://user@host:2222` and bracketed IPv6. An SSH alias from ~/.ssh/config is used as written,
+ * so pass `--control-url` when the alias is not a name or address clients can reach.
+ */
+export function defaultControlUrl(sshTarget, port) {
+    let host = sshTarget
+        .trim()
+        .replace(/^ssh:\/\//, '')
+        .replace(/\/.*$/, '');
+    host = host.replace(/^[^@]*@/, '');
+    const bracketed = /^\[([^\]]+)\]/.exec(host);
+    if (bracketed)
+        host = bracketed[1];
+    else if (host.split(':').length === 2)
+        host = host.split(':')[0];
+    if (!host || /[\s'"]/.test(host))
+        throw new Error(`cannot derive a host from SSH target ${sshTarget}`);
+    return `https://${host.includes(':') ? `[${host}]` : host}:${port}`;
 }

package/dist/cli-status.d.ts

@@ -0,0 +1,29 @@
+/** The control status endpoint returns database rows and a JSON-encoded node report. */
+export interface StatusResponse {
+    projects: {
+        id: string;
+        current_deployment_id: string | null;
+    }[];
+    deployments: {
+        id: string;
+        version: string;
+        state: string;
+        error_message: string | null;
+    }[];
+    nodes: {
+        id: string;
+        name: string;
+        status: string;
+        last_seen_at: string | null;
+    }[];
+    statuses: {
+        project_id: string;
+        node_id: string;
+        node: string | null;
+        health: string;
+        observed_version: string | null;
+        status_json: string;
+    }[];
+}
+/** Render observations without treating a stale node's last report as current health. */
+export declare function formatStatus(status: StatusResponse): string;

package/dist/cli-status.js

@@ -0,0 +1,61 @@
+/** Render observations without treating a stale node's last report as current health. */
+export function formatStatus(status) {
+    const lines = [];
+    const nodes = new Map(status.nodes.map((node) => [node.id, node]));
+    for (const project of [...status.projects].sort((a, b) => a.id.localeCompare(b.id))) {
+        const deployment = status.deployments.find((item) => item.id === project.current_deployment_id);
+        lines.push(`Project ${project.id}`);
+        if (deployment) {
+            lines.push(`  Deployment: ${deployment.version} (${deployment.state})`);
+            if (deployment.error_message)
+                lines.push(`  Error: ${deployment.error_message}`);
+        }
+        else {
+            lines.push(project.current_deployment_id
+                ? '  Deployment: current deployment not in recent results'
+                : '  Deployment: none');
+        }
+        const reports = status.statuses
+            .filter((item) => item.project_id === project.id)
+            .sort((a, b) => (a.node || a.node_id).localeCompare(b.node || b.node_id));
+        if (!reports.length)
+            lines.push('  No node reports');
+        for (const report of reports) {
+            const node = nodes.get(report.node_id);
+            lines.push(`  Node ${report.node || report.node_id}: ${node?.status || 'unknown'}; last reported ${report.health}${report.observed_version ? ` (${report.observed_version})` : ''}`);
+            try {
+                const detail = JSON.parse(report.status_json);
+                if (detail &&
+                    typeof detail === 'object' &&
+                    'error' in detail &&
+                    typeof detail.error === 'string' &&
+                    detail.error)
+                    lines.push(`    Error: ${detail.error}`);
+                if (detail &&
+                    typeof detail === 'object' &&
+                    'serviceStates' in detail &&
+                    detail.serviceStates &&
+                    typeof detail.serviceStates === 'object') {
+                    for (const [name, state] of Object.entries(detail.serviceStates).sort(([a], [b]) => a.localeCompare(b))) {
+                        if (!state || typeof state !== 'object')
+                            continue;
+                        const item = state;
+                        if (typeof item.rolloutState === 'string')
+                            lines.push(`    ${name}: ${item.rolloutState}${typeof item.rolloutError === 'string' && item.rolloutError ? ` — ${item.rolloutError}` : ''}`);
+                    }
+                }
+            }
+            catch {
+                lines.push('    Report details unavailable');
+            }
+        }
+    }
+    if (!status.projects.length)
+        lines.push('No projects');
+    lines.push('', 'Nodes');
+    if (!status.nodes.length)
+        lines.push('  No nodes');
+    for (const node of [...status.nodes].sort((a, b) => a.name.localeCompare(b.name)))
+        lines.push(`  ${node.name}: ${node.status}; last seen ${node.last_seen_at || 'never'}`);
+    return lines.join('\n');
+}

package/dist/cli.js

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
+import { isNodeHost } from "./node-address.js";
 import { Command, Option } from 'commander';
 import { openAsBlob } from 'node:fs';
 import { applyConfigDefaults, integerOption, normalizeControlUrl, nodeSettings, resolveCliConfig, writeInitConfig, } from "./cli-config.js";
-import { dockerRunSnippet, enrollmentCloudInit, shellQuote as sh, HOST_NETWORK_FLAG, MESH_RUN_FLAGS, CONTROL_CONTAINER, controlPortCheck, localImageBuildArgs, meshPortCheck, } from "./cli-install.js";
-import { createSourceArchive, prepareLocalImages } from "./cli-build.js";
+import { dockerRunSnippet, enrollmentCloudInit, shellQuote as sh, HOST_NETWORK_FLAG, CONTROL_CONTAINER, defaultControlUrl, controlPortCheck, localImageBuildArgs, } from "./cli-install.js";
+import { createLocalBuildSnapshot, createSourceArchive, prepareLocalImages } from "./cli-build.js";
 import { saveImageArchive } from "./artifacts.js";
 import { spawnSync } from 'node:child_process';
 import fs from 'node:fs/promises';
@@ -16,6 +17,7 @@ import { errMessage, loadTemplate } from "./util.js";
 import { createTransport } from "./agent-credential.js";
 import { decodeCredential, writeFileDurable } from "./pki.js";
 import { backupCheckProblems } from "./backup-check.js";
+import { formatStatus } from "./cli-status.js";
 import { PROJECT_NAME_PATTERN, ROLES, CREDENTIAL_NAME_PATTERN } from "./credentials.js";
 import { packageVersion, resolveImage } from "./image.js";
 import { TERMINAL_DEPLOYMENT_STATES } from "./protocol.js";
@@ -85,7 +87,7 @@ function runCapture(cmd, args, opts = {}) {
         throw new Error(`${cmd} ${args.join(' ')} failed\n${result.stderr || ''}`);
     return String(result.stdout);
 }
-function preflightRemote(target, { controlUrl, ports = [], udpPorts = [], minDiskMb = 1024, mesh = false, compose = false, } = {}) {
+function preflightRemote(target, { controlUrl, ports = [], minDiskMb = 1024, compose = false, } = {}) {
     const checks = [
         [
             'docker.version',
@@ -119,20 +121,6 @@ function preflightRemote(target, { controlUrl, ports = [], udpPorts = [], minDis
             `Port ${port} is already in use on the target host by something other than the Tug control container; stop the conflicting service or choose another port.`,
         ]);
     }
-    if (mesh) {
-        checks.push([
-            'wireguard.kernel',
-            'ip link add tugwgtest type wireguard && ip link del tugwgtest || modprobe -n wireguard 2>/dev/null',
-            'Install WireGuard (kernel 5.6+ has it built in; older kernels need the wireguard-dkms package) and ensure iproute2 is present.',
-        ]);
-    }
-    for (const port of udpPorts) {
-        checks.push([
-            `udp.${port}.free`,
-            meshPortCheck(port),
-            `UDP port ${port} is in use by something other than this node's running Tug mesh agent (or the ss tool is missing). Stop the conflicting service, or choose another port with --wg-port and set TUG_WG_PORT on control.`,
-        ]);
-    }
     if (controlUrl)
         checks.push([
             'control.reachable',
@@ -219,33 +207,27 @@ program
     .requiredOption('--csr <file>', 'PEM certificate request generated on the node (- for stdin)')
     .option('--mode <mode>', 'create a new node or replace an existing node key', 'create')
     .option('--address <addr>')
-    .option('--public-address <addr>')
     .option('--label <label>', 'node label (repeatable)', collect, [])
     .action(async (name, o) => {
     if (o.mode !== 'create' && o.mode !== 'replace')
         throw new Error("--mode must be 'create' or 'replace'");
     const csr = o.csr === '-' ? await readStdin() : await fs.readFile(o.csr, 'utf8');
-    const r = await request('POST', `/api/v1/nodes/${encodeURIComponent(name)}/identity`, { csr, mode: o.mode, address: o.address, publicAddress: o.publicAddress, labels: o.label });
+    const r = await request('POST', `/api/v1/nodes/${encodeURIComponent(name)}/identity`, { csr, mode: o.mode, address: o.address, labels: o.label });
     console.log(JSON.stringify(r, null, 2));
 });
+program
+    .command('node-address <name> <address>')
+    .description("update a node's inter-node address")
+    .action(async (name, address) => {
+    console.log(JSON.stringify(await request('POST', `/api/v1/nodes/${encodeURIComponent(name)}/address`, { address }), null, 2));
+});
 program
     .command('node-disable <name>')
     .description("block a node's key immediately without deleting its metadata or placement (no SSH needed); bring it back with node-replace-identity")
     .action(async (name) => console.log(JSON.stringify(await request('POST', `/api/v1/nodes/${encodeURIComponent(name)}/disable`, {}), null, 2)));
-program
-    .command('node-rotate-wg-key <name>')
-    .description('generate a new WireGuard keypair on the node; peers pick up the new public key on their next poll')
-    .option('--timeout <seconds>', 'wait timeout', '60')
-    .action(async (name, o) => {
-    const created = await request('POST', `/api/v1/nodes/${encodeURIComponent(name)}/rotate-wg-key`, {});
-    const cmd = await waitForCommand(created.commandId, Number(o.timeout));
-    if (cmd.state === 'failed')
-        throw new Error(JSON.parse(cmd.result_json || '{}').error || 'key rotation failed');
-    console.log(JSON.stringify({ ok: true, node: name, ...JSON.parse(cmd.result_json || '{}') }, null, 2));
-});
 program
     .command('node-remove <name>')
-    .description('remove a retired node from the control plane (its identity, WireGuard peer, statuses and queued commands); stop its agent and remove its containers on the host yourself')
+    .description('remove a retired node from the control plane (its identity, statuses and queued commands); stop its agent and remove its containers on the host yourself')
     .option('--force', 'remove even if the node is still reporting')
     .action(async (name, o) => {
     console.log(JSON.stringify(await request('DELETE', `/api/v1/nodes/${encodeURIComponent(name)}${o.force ? '?force=true' : ''}`), null, 2));
@@ -272,7 +254,6 @@ program
 program
     .command('control-install <sshTarget>')
     .description('install the control plane on a Docker-capable host over SSH and issue the root credential into a local 0600 file; it listens for mTLS only, so front it with TCP passthrough rather than a terminating proxy')
-    .requiredOption('--public-url <url>', 'credential-free https origin clients use, including the published port')
     .option('--extra-san <name>', 'additional DNS name or IP for the server certificate (repeatable)', collect, [])
     .option('--image <tag>', "Tug image to run (default: ghcr.io/wpelevator/tug:<this CLI's version>)")
     .option('--install-docker', 'install missing Docker Engine and Compose on supported Debian, Ubuntu, Fedora and RHEL-compatible hosts (root required)')
@@ -280,9 +261,12 @@ program
     .option('--port <port>', 'published mTLS port', '8443')
     .option('--credential-out <file>', 'where to write the root credential', 'tug-root.credential.json')
     .option('--recover-root', "replace root's key from the control host without the API (lost credential); other admins are unaffected")
-    .option('--mesh', 'enable the WireGuard mesh on control (TUG_MESH=true); install nodes with --mesh too')
     .action(async (sshTarget, o) => {
-    const publicUrl = normalizeControlUrl(o.publicUrl);
+    const cfg = await loadCfg();
+    // The control URL clients use: --control-url, TUG_CONTROL_URL or the config's controlUrl, else the SSH target's host
+    // and the published port. Clients verify a name generated from the CA, so this is only an address.
+    const controlUrl = cfg.requestedControlUrl ?? defaultControlUrl(sshTarget, o.port);
+    console.error(`control URL: ${controlUrl} (${cfg.requestedControlUrl ? 'from --control-url, TUG_CONTROL_URL or the config file' : 'from the SSH target and --port'}); clients connect there by default`);
     if (o.installDocker)
         await bootstrapDocker(sshTarget, true);
     preflightRemote(sshTarget, { ports: [Number(o.port)], minDiskMb: 2048, compose: true });
@@ -292,10 +276,9 @@ program
     const yamlValue = (value) => JSON.stringify(value);
     const compose = await loadTemplate(templatesDir, 'control-compose.yml', {
         IMAGE: yamlValue(image),
-        PUBLIC_URL: yamlValue(new URL(publicUrl).origin),
+        CONTROL_URL: yamlValue(new URL(controlUrl).origin),
         EXTRA_SANS: yamlValue(o.extraSan.join(',')),
         PORT: o.port,
-        MESH: yamlValue(o.mesh ? 'true' : 'false'),
     });
     const remote = await loadTemplate(templatesDir, 'control-install.sh', {
         COMPOSE: compose,
@@ -316,7 +299,7 @@ program
         await writeFileDurable(o.credentialOut, `${String(out.stdout).trim()}\n`, 0o600);
         console.error(`root credential written to ${o.credentialOut}; import it with: tug init ${o.credentialOut}`);
     }
-    console.log(JSON.stringify({ ok: true, sshTarget, url: publicUrl }, null, 2));
+    console.log(JSON.stringify({ ok: true, sshTarget, url: controlUrl }, null, 2));
 });
 const AGENT_STATE = '/var/lib/tug';
 function addNodeIdentityOptions(command) {
@@ -324,8 +307,6 @@ function addNodeIdentityOptions(command) {
         .option('--name <name>', 'node name')
         .option('--all', 'walk every node with an ssh target in the config file, continuing after failures')
         .option('--agent-control-url <url>', 'connect-only URL the agent dials (for example a private address); the certificate is still verified against the credential URL')
-        .option('--mesh', 'join the WireGuard mesh (agent runs with host networking and NET_ADMIN; control needs TUG_MESH=true)')
-        .option('--wg-port <port>', 'WireGuard UDP port checked by preflight', '51820')
         .option('--image <tag>', "Tug image to run (default: ghcr.io/wpelevator/tug:<this CLI's version>)")
         .option('--install-docker', 'install missing Docker Engine and Compose on supported Debian, Ubuntu, Fedora and RHEL-compatible hosts (root required)')
         .option('--build-local-image', 'build the image from the current checkout and copy it to the host over SSH (tags it tug:local unless --image is set); for development')
@@ -335,7 +316,9 @@ function addNodeIdentityOptions(command) {
  * The SSH-assisted flow: the node makes its own key and CSR, an admin credential authorizes the identity at this moment and
  * the certificate is installed back over SSH, so no bootstrap secret travels and the private key never leaves the node.
  */
-async function installNodeIdentity(sshTarget, name, mode, o, repair = false) {
+async function installNodeIdentity(sshTarget, name, mode, o, repair = false, 
+/** False in batch mode, where only the final per-node results are printed. */
+print = true) {
     const cfg = await loadCfg();
     const connectUrl = o.agentControlUrl ? normalizeControlUrl(o.agentControlUrl) : undefined;
     await transportFor(cfg).then((t) => t.close()); // fail before touching the host when there is no credential
@@ -343,8 +326,6 @@ async function installNodeIdentity(sshTarget, name, mode, o, repair = false) {
         await bootstrapDocker(sshTarget);
     preflightRemote(sshTarget, {
         controlUrl: connectUrl ?? cfg.credential?.url,
-        mesh: o.mesh,
-        udpPorts: o.mesh ? [Number(o.wgPort)] : [],
     });
     const image = resolveImage(o.image, o.buildLocalImage);
     if (o.buildLocalImage)
@@ -358,18 +339,18 @@ async function installNodeIdentity(sshTarget, name, mode, o, repair = false) {
         ]);
     const agent = (command, interactive = false) => `mkdir -p ${AGENT_STATE} && docker run --rm ${interactive ? '-i ' : ''}-v ${AGENT_STATE}:${AGENT_STATE} ${sh(image)} agent ${command}`;
     const csr = runCapture('ssh', ['--', sshTarget, agent('identity')]);
-    const response = await request('POST', `/api/v1/nodes/${encodeURIComponent(name)}/identity`, { csr, mode, address: o.address, publicAddress: o.publicAddress, labels: o.label });
+    const response = await request('POST', `/api/v1/nodes/${encodeURIComponent(name)}/identity`, { csr, mode, address: o.address, labels: o.label });
     runCapture('ssh', ['--', sshTarget, agent('install-cert', true)], {
         input: JSON.stringify(response),
     });
-    const env = (await loadTemplate(templatesDir, 'agent.env', {
+    const env = await loadTemplate(templatesDir, 'agent.env', {
         CONTROL_URL_LINE: connectUrl ? `TUG_CONTROL_URL=${connectUrl}\n` : '',
         NODE_NAME: name,
-    })) + (o.mesh ? 'TUG_MESH=true\n' : '');
+    });
     const remote = await loadTemplate(templatesDir, 'node-install.sh', {
         ENV: env,
         IMAGE_SH: sh(image),
-        RUN_FLAGS: `${o.mesh ? MESH_RUN_FLAGS : HOST_NETWORK_FLAG} `,
+        RUN_FLAGS: `${HOST_NETWORK_FLAG} `,
     });
     runLocal('ssh', ['--', sshTarget, remote]);
     if (o.wait) {
@@ -377,15 +358,19 @@ async function installNodeIdentity(sshTarget, name, mode, o, repair = false) {
         for (let i = 0; i < 30; i++) {
             const { nodes } = await request('GET', '/api/v1/nodes');
             const seen = nodes.find((n) => n.name === name)?.last_seen_at;
-            if (seen && seen > started)
-                return void console.log(JSON.stringify({ ok: true, node: response.node }, null, 2));
+            if (seen && seen > started) {
+                if (print)
+                    console.log(JSON.stringify({ ok: true, node: response.node }, null, 2));
+                return;
+            }
             await new Promise((r) => setTimeout(r, 2000));
         }
         console.error(`node ${name} has not reported yet; check \`docker logs tug-agent\` on the host`);
     }
-    console.log(JSON.stringify({ ok: true, node: response.node }, null, 2));
+    if (print)
+        console.log(JSON.stringify({ ok: true, node: response.node }, null, 2));
 }
-async function runNodeIdentity(sshArgument, o, mode, repair = false) {
+async function runNodeIdentity(sshArgument, o, mode, command, repair = false) {
     const cfg = await loadCfg();
     const verb = repair
         ? 'node-repair-identity'
@@ -398,9 +383,10 @@ async function runNodeIdentity(sshArgument, o, mode, repair = false) {
             const target = settings.ssh;
             if (!target)
                 continue;
-            const merged = { ...o, ...nodeOverrides(settings), name };
+            const merged = { ...o, name };
+            applyConfigDefaults(command, merged, nodeSettings(cfg, name));
             try {
-                await installNodeIdentity(target, name, mode, merged, repair);
+                await installNodeIdentity(target, name, mode, merged, repair, false);
                 results.push({ node: name, ok: true });
             }
             catch (e) {
@@ -419,12 +405,6 @@ async function runNodeIdentity(sshArgument, o, mode, repair = false) {
         throw new Error(`${verb} needs an SSH target: pass <ssh-target> or set nodes.${o.name}.ssh in ${cfg.file}`);
     await installNodeIdentity(sshTarget, o.name, mode, o, repair);
 }
-const nodeOverrides = (settings) => ({
-    ...(settings.address ? { address: settings.address } : {}),
-    ...(settings.publicAddress ? { publicAddress: settings.publicAddress } : {}),
-    ...(Array.isArray(settings.label) ? { label: settings.label } : {}),
-    ...(settings.mesh ? { mesh: true } : {}),
-});
 for (const [verb, description, mode, repair] of [
     [
         'node-install',
@@ -449,22 +429,23 @@ for (const [verb, description, mode, repair] of [
         .command(`${verb} [sshTarget]`)
         .description(description)
         .option('--address <addr>')
-        .option('--public-address <addr>')
         .option('--label <label>', 'node label (repeatable)', collect, []);
-    addNodeIdentityOptions(command).action(async (sshArgument, o) => runNodeIdentity(sshArgument, o, mode, repair));
+    addNodeIdentityOptions(command).action(async (sshArgument, o, command) => runNodeIdentity(sshArgument, o, mode, command, repair));
 }
 program
     .command('node-prepare-enrollment')
     .description('mint a single-use, name-bound join key so a host you cannot SSH to can self-join with one docker run; a saved cloud-init document contains a credential')
     .requiredOption('--name <name>', 'the node name the key is bound to; mint one key per instance')
+    .option('--address <addr>', 'private inter-node address for this node')
     .option('--agent-control-url <url>', 'connect-only URL the agent dials; the certificate is still verified against the credential URL')
     .option('--ttl <seconds>', 'join key lifetime', '3600')
     .option('--image <tag>', "agent image used in the printed docker run (default: ghcr.io/wpelevator/tug:<this CLI's version>)")
-    .option('--mesh', 'print a docker run that joins the WireGuard mesh (host networking, NET_ADMIN)')
     .option('--label <label>', 'node label (repeatable)', collect, [])
     .option('--install-docker', 'print cloud-init that installs Docker and starts the agent')
     .option('--json', 'print JSON including the command or cloud-init payload')
     .action(async (o) => {
+    if (o.address !== undefined && !isNodeHost(o.address))
+        throw new Error('address must be an IP address or hostname without a port');
     const connectUrl = o.agentControlUrl ? normalizeControlUrl(o.agentControlUrl) : undefined;
     const minted = await request('POST', '/api/v1/nodes/enrollment-credential', {
         name: o.name,
@@ -478,7 +459,7 @@ program
         ...(connectUrl ? { connectUrl } : {}),
     };
     const joinKey = Buffer.from(JSON.stringify(keyPayload)).toString('base64url');
-    const command = dockerRunSnippet(resolveImage(o.image), joinKey, o.mesh);
+    const command = dockerRunSnippet(resolveImage(o.image), joinKey, o.address);
     const cloudInit = o.installDocker
         ? enrollmentCloudInit(await dockerBootstrap(), command)
         : undefined;
@@ -730,6 +711,7 @@ async function makeContext() {
         await createSourceArchive(process.cwd(), tmp, [
             resolvedConfig.file,
             resolvedConfig.localFile,
+            ...(resolvedConfig.credentialFile ? [resolvedConfig.credentialFile] : []),
         ]);
     }
     catch (error) {
@@ -757,7 +739,14 @@ program
         const directory = await fs.mkdtemp(path.join(os.tmpdir(), 'tug-local-build-'));
         try {
             const form = new FormData();
-            const localImages = await prepareLocalImages(compose, process.cwd(), directory);
+            const source = Object.values(compose.services).some((service) => service.build)
+                ? await createLocalBuildSnapshot(process.cwd(), directory, [
+                    cfg.file,
+                    cfg.localFile,
+                    ...(cfg.credentialFile ? [cfg.credentialFile] : []),
+                ])
+                : process.cwd();
+            const localImages = await prepareLocalImages(compose, source, directory);
             for (const { field } of localImages)
                 form.append(field, await openAsBlob(path.join(directory, `${field}.tar.gz`)), `${field}.tar.gz`);
             form.append('payload', JSON.stringify({ project, version, compose, localImages }));
@@ -791,7 +780,11 @@ program
 });
 program
     .command('status')
-    .action(async () => console.log(JSON.stringify(await request('GET', '/api/v1/status'), null, 2)));
+    .option('--human', 'show a readable summary instead of JSON')
+    .action(async (o) => {
+    const status = await request('GET', '/api/v1/status');
+    console.log(o.human ? formatStatus(status) : JSON.stringify(status, null, 2));
+});
 program
     .command('events')
     .description('list recent events with the credential that caused each control action; defaults to the resolved project')
@@ -983,7 +976,6 @@ program.hook('preAction', async (_root, command) => {
     const options = command.opts();
     for (const [key, min, max] of [
         ['port', 1, 65535],
-        ['wgPort', 1, 65535],
         ['timeout', 1, 86400],
         ['ttl', 1, 31536000],
         ['uses', 1, 1000000],
@@ -1031,7 +1023,9 @@ program.hook('preAction', async (_root, command) => {
             : undefined;
     applyConfigDefaults(command, options, {
         ...resolvedConfig.commandDefaults,
-        ...(command.name().startsWith('node-') ? nodeSettings(resolvedConfig, nodeName) : {}),
+        ...(command.name().startsWith('node-') || command.name() === 'control-install'
+            ? nodeSettings(resolvedConfig, nodeName)
+            : {}),
     });
 });
 for (const command of program.commands) {

package/dist/compose.d.ts

@@ -36,6 +36,8 @@ export declare function isRolling(svc: ComposeService | undefined): boolean;
 export declare const SUPPORTED_SERVICE_KEYS: readonly string[];
 /** Lower-cased ingress hostnames a Compose definition claims, by `service` name. */
 export declare function ingressHostsOf(compose: ComposeFile): Map<string, string>;
+/** True when two lowercase ingress hosts could route the same request: equal, or one is a `*.` wildcard covering the other. */
+export declare function ingressHostsOverlap(a: string, b: string): boolean;
 export declare function validateCompose(compose: ComposeFile | undefined, nodes?: string[]): asserts compose is ComposeFile;
 export interface BuildDesiredStateOptions {
     project: string;