clavarium 0.1.0-next.7 → 0.1.0-next.9

package/README.md

@@ -216,8 +216,14 @@ The host needs `tmux` and `bindfs` (the read-only views).
     # the stable version from npm, in local mode, asking nothing (Node.js pinned and
     # checked first); it prints the next command and the public keys (text and QR)
     curl -fsSL https://clavarium.org/install.sh | sudo bash
-    # then online: HTTPS, an administrator, a password shown once -- after a real
-    # test from the internet (Let's Encrypt staging); the relay is set up over SSH
+    # online in the same line: it installs, shows the setup key (text and QR), asks for the
+    # relay's address once you made it with that key, waits for your DNS, sets the relay up
+    # over SSH, tests from the internet, shows the password once
+    DOMAIN=<your-domain>
+    EMAIL=<your-email>
+    curl -fsSL https://clavarium.org/install.sh | sudo bash -s -- --domain "$DOMAIN" --admin "$EMAIL" --relay-user ubuntu
+    curl -fsSL https://clavarium.org/install.sh | sudo bash -s -- --direct --domain "$DOMAIN"
+    # or later, from local mode
     sudo clavarium online --relay relay.example.net --domain clav.example.com
     sudo clavarium online --port --domain clav.example.com
     sudo clavarium key                  # the public keys again

package/deploy/online.mjs

@@ -24,8 +24,9 @@
  * `sys`, so the tests can stand in for SSH, npm and DNS.
  */
 import { spawn } from 'node:child_process';
-import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync, mkdtempSync, renameSync, openSync, readSync, writeSync, closeSync } from 'node:fs';
+import { createReadStream, existsSync, mkdirSync, readFileSync, writeFileSync, rmSync, mkdtempSync, renameSync, openSync, readSync, writeSync, closeSync } from 'node:fs';
 import { promises as dns } from 'node:dns';
+import { connect } from 'node:net';
 import { createInterface } from 'node:readline';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
@@ -62,7 +63,7 @@ export const USAGE = [
 ].join('\n');
 
 export function parseOnline(args) {
-    const o = { relay: '', user: 'root', relayPort: '22', domain: '', admin: '', fingerprint: '', keepSetupKey: false, yes: false, port: false };
+    const o = { askRelay: false, relay: '', user: 'root', relayPort: '22', domain: '', admin: '', fingerprint: '', keepSetupKey: false, yes: false, port: false };
     const value = (i, name) => { const v = args[i + 1]; if (v === undefined || v.startsWith('--')) throw new Bad(`${name} needs a value`); return v; };
     for (let i = 0; i < args.length; i++) {
         const a = args[i];
@@ -79,12 +80,15 @@ export function parseOnline(args) {
             default: throw new Bad(`unknown parameter: ${a}`);
         }
     }
-    if (!o.relay === !o.port) throw new Bad('say how it will be reached: --relay HOST or --port');
+    if (o.relay && o.port) throw new Bad('say how it will be reached: --relay HOST or --port, not both');
+    /* Neither: through a relay that does not exist yet -- its key is shown first,
+       and its address asked once the operator has made it with that key. */
+    if (!o.relay && !o.port) o.askRelay = true;
     if (!DOMAIN.test(o.domain)) throw new Bad('--domain is a host name, lower case, like clav.example.com');
     o.admin ||= `admin@${o.domain}`;
     if (!EMAIL.test(o.admin)) throw new Bad('--admin is an e-mail address, lower case');
-    if (o.relay) {
-        if (!HOST.test(o.relay)) throw new Bad('--relay is the name or the address of the relay machine');
+    if (o.relay || o.askRelay) {
+        if (o.relay && !HOST.test(o.relay)) throw new Bad('--relay is the name or the address of the relay machine');
         if (!USER.test(o.user)) throw new Bad('--relay-user is an account name');
         if (!/^\d{1,5}$/.test(o.relayPort) || +o.relayPort < 1 || +o.relayPort > 65535) throw new Bad('--relay-port is a port number');
         if (o.fingerprint && !PRINT.test(o.fingerprint)) throw new Bad('--relay-fingerprint looks like SHA256:... (ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub on the relay)');
@@ -144,7 +148,7 @@ export async function showKeys(sys, P = PATHS, { which = 'all' } = {}) {
 
 /* ---------------------------------- SSH ---------------------------------- */
 const sshOptions = (key, knownHosts, port) => [
-    '-o', 'BatchMode=yes', '-o', 'IdentitiesOnly=yes', '-o', `IdentityFile=${key}`,
+    '-o', 'BatchMode=yes', '-o', 'IdentitiesOnly=yes', '-o', `IdentityFile=${key}`, '-o', 'PreferredAuthentications=publickey', '-o', 'NumberOfPasswordPrompts=0',
     '-o', `UserKnownHostsFile=${knownHosts}`, '-o', 'StrictHostKeyChecking=yes', '-o', 'ConnectTimeout=10', '-p', String(port),
 ];
 const quote = (s) => `'${String(s).replace(/'/g, `'\\''`)}'`;
@@ -215,6 +219,19 @@ export async function checkDns(sys, o) {
     return got;
 }
 
+/* The domain made to point to the relay while the operator is at it: waited for
+   (every 30 s, Enter to look now), the record to make said once. */
+export async function waitDns(sys, o) {
+    let said = false;
+    for (;;) {
+        const relay = await addresses(sys, o.relay);
+        const got = await addresses(sys, o.domain);
+        if (relay.length && got.some((a) => relay.includes(a))) return;
+        if (!said && relay.length) { said = true; sys.print(`At your DNS provider, point the domain to the relay:\n    ${o.domain}  A  ${relay[0]}\nWaiting for it (it takes a few minutes) -- or press Enter to look now.`); }
+        await (sys.sleepOrEnter ? sys.sleepOrEnter(30_000) : sys.sleep(30_000));
+    }
+}
+
 /* ------------------------ the test from the internet ------------------------ */
 /* What Let's Encrypt (or Caddy) said, as the operator needs to read it. */
 export function explain(error, { domain, port, relay }) {
@@ -304,12 +321,34 @@ async function fingerprintOf(sys, P, line) {
     return { file, print };
 }
 
-async function waitForSetupKey(sys, o, at, deadline) {
+/* NOT BANNED WHILE WAITING. A relay may run fail2ban (by default: banned after
+   5 failed logins in 10 minutes). So: while its SSH port does not even answer,
+   only that port is looked at (no login, nothing counted); once it answers,
+   one key, one try, then 5 minutes, a second, 5 minutes, a third (the
+   operator's rule): after three failures it waits for Enter on the keyboard
+   (with --yes and no keyboard: 5 minutes more each time). */
+export const KNOCK_MS = 5 * 60_000;
+export const KNOCKS = 3;
+const portAnswers = (host, port, ms = 5000) => new Promise((resolve) => {
+    const s = connect({ host, port: Number(port) });
+    const done = (ok) => { s.destroy(); resolve(ok); };
+    s.setTimeout(ms, () => done(false)); s.once('connect', () => done(true)); s.once('error', () => done(false));
+});
+export async function waitForSetupKey(sys, o, at, deadline) {
     const check = o.user === 'root' ? 'true' : 'sudo -n true';
     let said = '';
     const say = (text) => { if (text !== said) { said = text; sys.print(text); } };
+    let tries = 0;
+    const knock = sys.portAnswers ?? portAnswers;
     for (;;) {
+        if (!(await knock(o.relay, o.relayPort ?? 22))) {
+            say(`${o.relay} does not answer on its SSH port yet: waiting, without trying to log in...`);
+            if (sys.now() > deadline) throw new Failed(`${o.relay} did not answer on its SSH port within ${WAIT_MS / 60000} minutes`);
+            await sys.sleep(15_000);
+            continue;
+        }
         const r = await sys.run(['ssh', ...at, `${o.user}@${o.relay}`, check]);
+        tries += 1;
         if (r.code === 0) { sys.print(`The setup key opens ${o.user}@${o.relay}${o.user === 'root' ? '' : ', with sudo'}.`); return; }
         const err = r.err || '';
         if (/password is required|not in the sudoers|may not run sudo/i.test(err)) say(`${o.user} on ${o.relay} needs sudo without a password: add "${o.user} ALL=(ALL) NOPASSWD: ALL" in /etc/sudoers.d there. Waiting...`);
@@ -317,7 +356,14 @@ async function waitForSetupKey(sys, o, at, deadline) {
         else if (/Host key verification failed|REMOTE HOST IDENTIFICATION/i.test(err)) throw new Refused(`${o.relay} answered with another key than a moment ago: stopped`);
         else say(`${o.relay} does not answer yet (${tail(r)}). Waiting...`);
         if (sys.now() > deadline) throw new Failed(`the setup key was not accepted on ${o.user}@${o.relay} within ${WAIT_MS / 60000} minutes`);
-        await sys.sleep(5000);
+        if (tries >= KNOCKS && !o.yes && sys.waitEnter) {
+            sys.print(`   ${KNOCKS} tries refused: put the setup key on the relay, then press Enter to try again (Ctrl-C to stop).`);
+            if (!(await sys.waitEnter())) throw new Failed('no keyboard to wait on: run sudo clavarium online again once the key is on the relay');
+            tries = 0;
+            continue;
+        }
+        sys.print(`   next try in ${KNOCK_MS / 60_000} min (${tries} of ${KNOCKS})${sys.sleepOrEnter && !o.yes ? ' -- or press Enter to try now' : ''}`);
+        await (sys.sleepOrEnter && !o.yes ? sys.sleepOrEnter(KNOCK_MS) : sys.sleep(KNOCK_MS));
     }
 }
 
@@ -407,6 +453,17 @@ export async function online(o, sys, P = PATHS) {
     if (was) throw new Refused(`this machine is in server mode already: https://${was}`);
     if (!existsSync(P.caddy)) throw new Failed('the HTTPS programs are not on this machine: run the installer again (curl -fsSL https://clavarium.org/install.sh | sudo bash)');
     const keys = await ensureKeys(sys, P);
+    if (o.askRelay) {
+        await showKeys(sys, P, { which: 'setup' });
+        sys.print('Create the relay at your host now (Ubuntu), with the key above as its SSH key.');
+        for (;;) {
+            const a = String(await sys.askLine('Its address, once it exists (IP or name): ') ?? '').trim();
+            if (HOST.test(a)) { o.relay = a; break; }
+            if (!a && !sys.hasKeyboard?.()) throw new Failed('no keyboard to ask on: give --relay HOST');
+            sys.print('   That is not an address: an IP address, or a name like relay.example.com');
+        }
+        await waitDns(sys, o);
+    }
     await checkDns(sys, o);
     await portsFree(sys);
     if (o.relay) await setUpRelay(sys, P, o, keys);
@@ -478,6 +535,24 @@ export function realSys() {
             const exited = new Promise((resolve) => { child.on('error', () => { ended = true; resolve({ code: 127 }); }); child.on('close', (code) => { ended = true; resolve({ code: code ?? 1 }); }); });
             return { exited, ended: () => ended, stop: () => { if (!ended) child.kill('SIGTERM'); } };
         },
+        /* A wait that Enter on the keyboard cuts short (no keyboard: the whole wait). */
+        sleepOrEnter: (ms) => new Promise((resolve) => {
+            let tty; let timer;
+            const done = () => { clearTimeout(timer); try { tty?.destroy(); } catch { /* gone */ } resolve(); };
+            timer = setTimeout(done, ms);
+            try { tty = createReadStream('/dev/tty'); tty.on('data', (d) => { if (d.includes(10) || d.includes(13)) done(); }); tty.on('error', () => {}); } catch { /* no keyboard: the timer alone */ }
+        }),
+        hasKeyboard: () => { try { closeSync(openSync('/dev/tty', 'r')); return true; } catch { return false; } },
+        askLine: async (question) => {
+            let fd;
+            try { fd = openSync('/dev/tty', 'r+'); } catch { return ''; }
+            try { writeSync(fd, question); const buf = Buffer.alloc(512); let s = ''; while (!s.includes('\n')) { const n = readSync(fd, buf, 0, buf.length, null); if (!n) break; s += buf.toString('utf8', 0, n); } return s.split('\n')[0]; } finally { closeSync(fd); }
+        },
+        waitEnter: async () => {
+            let fd;
+            try { fd = openSync('/dev/tty', 'r'); } catch { return false; }
+            try { const buf = Buffer.alloc(256); let s = ''; while (!s.includes('\n')) { const n = readSync(fd, buf, 0, buf.length, null); if (!n) break; s += buf.toString('utf8', 0, n); } return true; } finally { closeSync(fd); }
+        },
         ask: async (question) => {
             let fd;
             try { fd = openSync('/dev/tty', 'r+'); } catch { return false; }

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "clavarium",
-  "version": "0.1.0-next.7",
+  "version": "0.1.0-next.9",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "clavarium",
-      "version": "0.1.0-next.7",
+      "version": "0.1.0-next.9",
       "license": "MIT",
       "dependencies": {
         "@xterm/addon-fit": "^0.11.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clavarium",
-  "version": "0.1.0-next.7",
+  "version": "0.1.0-next.9",
   "license": "MIT",
   "type": "module",
   "description": "A conversation is a VM with a terminal in it. Everything else is a folder.",