clavarium 0.1.0 → 0.1.2

package/deploy/clavarium.mjs

@@ -12,6 +12,8 @@
  *   sudo clavarium online --port --domain NAME [...]
  *   sudo clavarium key                                       the public keys, text and QR
  *   sudo clavarium relay status | repair | update-os | update-relay | forget-setup-key
+ *   sudo clavarium doctor [--fix]                            what works, what does not, what to do
+ *   sudo clavarium password EMAIL                            a new password for an administrator
  *
  * `install` runs deploy/install.sh of this package, which installs THIS
  * version from npm (checked) into /opt/clavarium/releases/X.Y.Z; every other
@@ -25,6 +27,18 @@ import { fileURLToPath } from 'node:url';
 const version = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version;
 const [verb, ...rest] = process.argv.slice(2);
 if (verb === '--version' || verb === '-v') { console.log(version); process.exit(0); }
+if (['doctor', 'password'].includes(verb)) {
+    const { doctor, newPassword, certificateWatch, installWatch } = await import('./doctor.mjs');
+    if (process.getuid?.() !== 0) { console.error(`clavarium ${verb}: run it as root: sudo clavarium ${verb} ...`); process.exit(78); }
+    const sys = (await import('./online.mjs')).realSys();
+    try {
+        if (verb === 'password') { await newPassword(sys, rest[0]); process.exit(0); }
+        if (rest.length === 1 && rest[0] === '--certificate') process.exit(await certificateWatch(sys));
+        if (rest.length === 1 && rest[0] === '--install-watch') { await installWatch(sys); process.exit(0); }
+        if (rest.some((a) => a !== '--fix')) throw new Error('usage: sudo clavarium doctor [--fix]');
+        process.exit((await doctor(sys, { fix: rest.includes('--fix') })) ? 1 : 0);
+    } catch (error) { console.error(`clavarium ${verb}: ${error.message}`); process.exit(1); }
+}
 if (['online', 'key', 'relay'].includes(verb)) {
     const o = await import('./online.mjs');
     if (process.getuid?.() !== 0) { console.error(`clavarium ${verb}: run it as root: sudo clavarium ${verb} ...`); process.exit(78); }
@@ -48,7 +62,9 @@ if (verb !== 'install') {
         + '  sudo clavarium online --relay HOST --domain NAME                  then online, through a relay of yours\n'
         + '  sudo clavarium online --port --domain NAME                        or with ports 80 and 443 open\n'
         + '  sudo clavarium key                                                the public keys again (text and QR)\n'
-        + '  sudo clavarium relay status|repair|update-os|update-relay|forget-setup-key\n\n'
+        + '  sudo clavarium relay status|repair|update-os|update-relay|forget-setup-key\n'
+        + '  sudo clavarium doctor [--fix]                                     what works, what does not, what to do\n'
+        + '  sudo clavarium password EMAIL                                     a new password for an administrator\n\n'
         + 'https://clavarium.org');
     process.exit(verb ? 64 : 0);
 }

package/deploy/doctor.mjs

@@ -0,0 +1,203 @@
+/* `sudo clavarium doctor [--fix]`: WHAT WORKS AND WHAT DOES NOT, each problem
+ * with what to do about it. Run at the end of `clavarium online` too.
+ *
+ *   the services (clavarium; in server mode the edge: caddy, dex, oauth2-proxy,
+ *   and the tunnel behind a relay), the domain's address, and the certificate
+ *   the front actually serves: a public one, valid, not about to expire.
+ *
+ * --fix does only what is safe and undoes nothing of the operator's: it starts
+ * a service that is down, and a certificate that is not a public one (made by
+ * Caddy itself when Let's Encrypt could not be reached: its fallback, so the
+ * site keeps answering) is dropped so that Caddy asks Let's Encrypt again.
+ * The same is done by itself every 20 minutes (--certificate, from a timer).
+ *
+ * A password lost: `sudo clavarium password EMAIL` makes a new one (Dex's
+ * static password of that administrator), shown once.
+ */
+import { readFileSync, writeFileSync, existsSync, rmSync, renameSync } from 'node:fs';
+
+export const DOCTOR_PATHS = {
+    unit: '/etc/systemd/system/clavarium.service',
+    relayConf: '/etc/clavarium/relay.conf',
+    caddyfile: '/etc/caddy/Caddyfile',
+    caddyData: '/var/lib/caddy/caddy',
+    dexConf: '/etc/dex/config.yaml',
+    caddy: '/usr/local/bin/caddy',
+    systemd: '/etc/systemd/system',
+};
+const EMAIL = /^[a-z0-9._+-]{1,64}@([a-z0-9-]{1,63}\.)+[a-z]{2,24}$/;
+
+const read = (f) => { try { return readFileSync(f, 'utf8'); } catch { return null; } };
+export const domainOf = (P) => /--public-origin https:\/\/(\S+)/.exec(read(P.unit) ?? '')?.[1] ?? null;
+const relayOf = (P) => /^HOST=(\S+)$/m.exec(read(P.relayConf) ?? '')?.[1] ?? null;
+
+async function active(sys, unit) {
+    const r = await sys.run(['systemctl', 'is-active', unit]);
+    return r.out.trim() === 'active';
+}
+
+/* What the front serves for the domain, read on the loopback: issuer, end, verified or not. */
+export async function servedCert(sys, domain) {
+    const r = await sys.run(['openssl', 's_client', '-connect', '127.0.0.1:443', '-servername', domain, '-verify_hostname', domain, '-showcerts'], { input: '' });
+    const pem = /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/.exec(r.out)?.[0];
+    if (!pem) return { none: true, why: (r.err || r.out).trim().split('\n').filter(Boolean).pop() ?? 'nothing answers on 443' };
+    const x = await sys.run(['openssl', 'x509', '-noout', '-issuer', '-enddate'], { input: pem });
+    const issuer = /issuer=\s*(.*)/.exec(x.out)?.[1]?.trim() ?? '?';
+    const end = Date.parse(/notAfter=(.*)/.exec(x.out)?.[1] ?? '');
+    const code = /Verify return code: (\d+) \(([^)]*)\)/.exec(r.out);
+    return { issuer, end, verified: code?.[1] === '0', why: code?.[2] ?? 'not verified', local: /Caddy Local Authority/i.test(issuer) };
+}
+
+/* The last error Caddy logged, in plain words. */
+async function caddyError(sys) {
+    const r = await sys.run(['journalctl', '-u', 'caddy', '-n', '300', '-o', 'cat', '--no-pager']);
+    const lines = r.out.split('\n').filter((l) => /"level":"error"/.test(l));
+    if (!lines.length) return null;
+    try { const j = JSON.parse(lines.at(-1)); return [j.msg, j.error].filter(Boolean).join(': ').slice(0, 300); } catch { return lines.at(-1).slice(0, 300); }
+}
+
+/* Each check: { what, ok, detail, fix (words), repair (what --fix does) }. */
+export async function diagnose(sys, P = DOCTOR_PATHS) {
+    const checks = [];
+    const add = (c) => { checks.push(c); return c; };
+    const domain = domainOf(P);
+    const relay = domain ? relayOf(P) : null;
+    const units = ['clavarium', ...(domain ? ['caddy', 'dex', 'oauth2-proxy'] : []), ...(relay ? ['clavarium-tunnel'] : [])];
+    for (const u of units) {
+        const ok = await active(sys, u);
+        add({ what: `service ${u}`, ok, detail: ok ? 'running' : 'not running', fix: `sudo systemctl restart ${u}; to see why: journalctl -u ${u} -n 50`, repair: ok ? null : 'restart', unit: u });
+    }
+    if (!domain) { add({ what: 'mode', ok: true, detail: 'local (this machine only): no certificate, no sign-in' }); return checks; }
+
+    const addrs = await sys.resolve(domain);
+    const want = !relay ? null : /^[0-9.]+$/.test(relay) ? [relay] : await sys.resolve(relay);
+    const dnsOk = addrs.length > 0 && (!want || !want.length || addrs.some((a) => want.includes(a)));
+    add({ what: `the name ${domain}`, ok: dnsOk, detail: addrs.length ? `leads to ${addrs.join(', ')}` : 'leads nowhere',
+        fix: relay ? `make ${domain} lead to the relay (${want?.join(', ') || relay}) at your DNS host` : `make ${domain} lead to this machine at your DNS host` });
+
+    const c = await servedCert(sys, domain);
+    const days = Number.isFinite(c.end) ? Math.floor((c.end - sys.now()) / 86_400_000) : null;
+    if (c.none) {
+        add({ what: 'certificate', ok: false, detail: c.why, fix: 'sudo systemctl restart caddy', repair: 'restart', unit: 'caddy' });
+    } else if (c.local || !c.verified) {
+        const err = await caddyError(sys);
+        add({ what: 'certificate', ok: false,
+            detail: `${c.local ? 'made by Caddy itself, not by Let\'s Encrypt: browsers warn' : `not valid (${c.why})`}; issuer ${c.issuer}${err ? `. Caddy's last error: ${err}` : ''}`,
+            fix: `check that ${domain} leads ${relay ? 'to the relay' : 'here'} and that port 80 reaches it, then: sudo clavarium doctor --fix (Caddy asks Let's Encrypt again; this is also tried by itself every 20 minutes)`,
+            repair: 'certificate' });
+    } else {
+        add({ what: 'certificate', ok: days === null || days >= 10, detail: `from ${c.issuer}${days === null ? '' : `, ${days} days left`}`,
+            fix: 'Caddy renews it by itself 30 days ahead; it has not: journalctl -u caddy -n 100, then sudo clavarium doctor --fix', repair: days !== null && days < 10 ? 'certificate' : null });
+    }
+    return checks;
+}
+
+export function report(sys, checks) {
+    const bad = checks.filter((c) => !c.ok);
+    sys.print('');
+    sys.print(`Diagnosis: ${bad.length ? `${bad.length} problem${bad.length > 1 ? 's' : ''}` : 'everything works'}`);
+    for (const c of checks) {
+        sys.print(`  ${c.ok ? 'ok ' : 'NO '} ${c.what}: ${c.detail}`);
+        if (!c.ok && c.fix) sys.print(`       what to do: ${c.fix}`);
+    }
+    return bad.length;
+}
+
+/* The certificate again from Let's Encrypt: the one Caddy made itself (its
+   fallback when Let's Encrypt could not be reached) is dropped and Caddy
+   restarted, so it asks Let's Encrypt again -- and falls back again if it still
+   fails: the site keeps answering, with a warning, never down. */
+async function renewCertificate(sys, P) {
+    const domain = domainOf(P);
+    const local = `${P.caddyData}/certificates/local/${domain}`;
+    if (domain && existsSync(local)) { rmSync(local, { recursive: true, force: true }); sys.print('   the certificate made by Caddy itself: dropped'); }
+    await sys.run(['systemctl', 'restart', 'caddy']);
+    sys.print('   Caddy restarted: it asks Let\'s Encrypt now');
+}
+
+/* `clavarium doctor --certificate`, every 20 minutes (clavarium-certificate.timer):
+   a certificate Caddy made itself is replaced by Let's Encrypt's as soon as it can.
+   Nothing is done while the certificate is a public one. 3 tries an hour at most:
+   under Let's Encrypt's limit of 5 failed validations an hour. */
+export async function certificateWatch(sys, P = DOCTOR_PATHS) {
+    const domain = domainOf(P);
+    if (!domain) return 0;
+    const c = await servedCert(sys, domain);
+    if (!c.none && !c.local) return 0;
+    sys.print(`${domain}: ${c.none ? 'no certificate served' : 'a certificate made by Caddy itself'}: asking Let's Encrypt again`);
+    await renewCertificate(sys, P);
+    return 0;
+}
+
+/* The timer of certificateWatch. Written by install.sh, and by doctor --fix on a
+   machine installed before it existed (an update does not rerun install.sh). */
+export const WATCH_SERVICE = `[Unit]
+Description=Clavarium - a certificate made by Caddy itself is replaced by Let's Encrypt's
+After=caddy.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/clavarium doctor --certificate
+`;
+export const WATCH_TIMER = `[Unit]
+Description=Clavarium - the certificate, every 20 minutes
+
+[Timer]
+OnBootSec=10min
+OnUnitActiveSec=20min
+
+[Install]
+WantedBy=timers.target
+`;
+export async function installWatch(sys, P = DOCTOR_PATHS) {
+    const svc = `${P.systemd}/clavarium-certificate.service`; const tim = `${P.systemd}/clavarium-certificate.timer`;
+    if (read(svc) === WATCH_SERVICE && read(tim) === WATCH_TIMER) return false;
+    writeFileSync(svc, WATCH_SERVICE); writeFileSync(tim, WATCH_TIMER);
+    await sys.run(['systemctl', 'daemon-reload']);
+    await sys.run(['systemctl', 'enable', '--now', '--quiet', 'clavarium-certificate.timer']);
+    return true;
+}
+
+export async function doctor(sys, { fix = false } = {}, P = DOCTOR_PATHS) {
+    let checks = await diagnose(sys, P);
+    let bad = report(sys, checks);
+    if (!bad) return 0;
+    const repairs = checks.filter((c) => !c.ok && c.repair);
+    if (!fix) { if (repairs.length) sys.print('To repair what can be: sudo clavarium doctor --fix'); return bad; }
+    sys.print('');
+    sys.print('Repairing:');
+    if (domainOf(P) && await installWatch(sys, P)) sys.print('   the certificate is now checked every 20 minutes (clavarium-certificate.timer)');
+    for (const c of repairs) {
+        if (c.repair === 'restart') { await sys.run(['systemctl', 'restart', c.unit]); sys.print(`   ${c.unit}: restarted`); }
+        if (c.repair === 'certificate') await renewCertificate(sys, P);
+    }
+    if (!repairs.length) { sys.print('   nothing this command can repair: see "what to do" above'); return bad; }
+    /* Let's Encrypt answers in seconds when all is well. */
+    for (let i = 0; i < 12; i += 1) {
+        await sys.sleep(10_000);
+        checks = await diagnose(sys, P);
+        if (checks.every((c) => c.ok)) break;
+    }
+    return report(sys, checks);
+}
+
+/* `sudo clavarium password EMAIL`: a new password for that administrator, shown once. */
+export async function newPassword(sys, email, P = DOCTOR_PATHS) {
+    if (!EMAIL.test(String(email ?? ''))) throw new Error('usage: sudo clavarium password EMAIL');
+    const conf = read(P.dexConf);
+    if (!conf) throw new Error('no administrators on this machine: it is in local mode (no sign-in)');
+    const at = conf.indexOf(`  - email: "${email}"\n    hash: "`);
+    if (at < 0) throw new Error(`${email} is not an administrator here`);
+    const pw = (await sys.run(['openssl', 'rand', '-base64', '18'])).out.trim().replace(/\+/g, '-').replace(/\//g, '_');
+    if (pw.length < 20) throw new Error('no random password could be made');
+    const hash = (await sys.run([P.caddy, 'hash-password'], { input: `${pw}\n` })).out.trim();
+    if (!/^\$2[aby]\$\d\d\$[./A-Za-z0-9]{53}$/.test(hash)) throw new Error('the password could not be hashed');
+    const start = at + `  - email: "${email}"\n    hash: "`.length;
+    const next = conf.slice(0, start) + hash + conf.slice(conf.indexOf('"', start));
+    writeFileSync(`${P.dexConf}.new`, next, { mode: 0o640 });
+    await sys.run(['chown', 'root:dex', `${P.dexConf}.new`]);
+    renameSync(`${P.dexConf}.new`, P.dexConf);
+    await sys.run(['systemctl', 'restart', 'dex']);
+    sys.print(`New password for ${email} (shown ONCE, kept nowhere in clear):`);
+    sys.print(`    ${pw}`);
+}

package/deploy/install.sh

@@ -263,15 +263,22 @@ if [ "$KEEP_RELEASE" = "yes" ]; then
     release="$(basename "$(readlink -f "$CODE/current")")"
     echo "   the release that runs is kept: $release"
 else
-if [ -n "$VERSION" ]; then
+if [ -n "$VERSION" ] && [ -L "$CODE/current" ] && [ "$(basename "$(readlink -f "$CODE/current")")" = "$VERSION" ]; then
+    # Run again with the version that runs already (a step after it failed, a
+    # DNS record made late): kept as it is, and the rest goes on.
+    release="$VERSION"
+    echo "   clavarium@$VERSION runs here already: kept"
+elif [ -n "$VERSION" ]; then
     echo "   clavarium@$VERSION from npm: fetched, checked, built, tried (a few minutes)"
     release="$(updater prepare --version "$VERSION")" || refuse "clavarium@$VERSION was not installed (above: why)"
 else
     echo "   the working tree $FROM_DIR (development): copied, built, tried"
     release="$(updater prepare --from-dir "$FROM_DIR")" || refuse "the working tree was not installed (above: why)"
 fi
-systemctl stop clavarium.service 2>/dev/null || true
-updater switch "$release"
+if [ "$(basename "$(readlink -f "$CODE/current" 2>/dev/null)")" != "$release" ]; then
+    systemctl stop clavarium.service 2>/dev/null || true
+    updater switch "$release"
+fi
 fi
 APP="$CODE/current/app"
 NODE="$CODE/current/node/bin/node"
@@ -531,7 +538,10 @@ else
 fi
 
 # Behind a relay, the front listens on the loopback only: the tunnel is the
-# one way in.
+# one way in. Let's Encrypt first; if it cannot be reached (a tunnel not up yet),
+# a certificate Caddy makes itself, so the site still answers (with a warning).
+# Caddy would keep that one for hours: clavarium-certificate.timer replaces it
+# with Let's Encrypt's as soon as it can (sudo clavarium doctor --certificate).
 BIND=""; [ -z "$RELAY" ] || BIND="	bind 127.0.0.1"
 cat > /etc/caddy/Caddyfile <<CADDY
 # The only thing on this machine that takes what comes from the outside.
@@ -614,6 +624,8 @@ PROXYUNIT
 systemctl daemon-reload
 systemctl enable --quiet caddy.service dex.service oauth2-proxy.service
 systemctl restart dex.service caddy.service oauth2-proxy.service
+# A certificate Caddy made itself (its fallback) replaced by Let's Encrypt's as soon as it can.
+/usr/local/bin/clavarium doctor --install-watch || echo "install: the certificate timer could not be set: sudo clavarium doctor --fix" >&2
 
 step "edge: checks"
 local_get() { curl -sk -o /dev/null -w '%{http_code}' --max-time 5 --resolve "$DOMAIN:443:127.0.0.1" "https://$DOMAIN$1" || true; }
@@ -685,7 +697,11 @@ fi
 
 echo
 echo "Clavarium is installed:   https://$DOMAIN"
-if [ -n "$PASSWORDS" ]; then
+if [ -n "$PASSWORDS" ] && [ -n "${CLAVARIUM_PASSWORDS_TO:-}" ]; then
+    # Run by `clavarium online`: it shows them LAST, where they do not scroll away, then deletes them.
+    ( umask 077; printf '%s' "$PASSWORDS" > "$CLAVARIUM_PASSWORDS_TO" )
+    echo "Sign in with: the password is shown at the very end."
+elif [ -n "$PASSWORDS" ]; then
     echo "Sign in with (shown ONCE, kept nowhere in clear):"
     printf '%s' "$PASSWORDS"
 else
@@ -695,14 +711,17 @@ if [ -n "$RELAY" ] && [ "$RELAY_INSTALLED" = "yes" ]; then
     echo "The relay $RELAY is set up; the tunnel comes up by itself.   Its fingerprint: $RELAY_PRINT"
 elif [ -n "$RELAY" ]; then
     echo
-    echo "ON THE RELAY ($RELAY), run this one command; the tunnel then comes up by itself:"
-    echo "    sudo deploy/relay.sh --key \"$TUNNEL_KEY\""
     # A server with a screen and a keyboard only: the key, carried by a phone.
     # It is a PUBLIC key: showing it is safe; it lets the relay know this machine.
+    # The QR code far from the key's text, so a phone reads the code, not the text.
     if command -v qrencode >/dev/null 2>&1 || apt-get install -y -qq qrencode >/dev/null 2>&1; then
-        echo "The same key, to read with a phone or a tablet:"
+        echo "The relay's tunnel key, as a QR code:"
+        echo "WARNING: read the QR code with the camera, not the text: some phones read the text on screen and get letters wrong, while the code is exact."
         qrencode -t ANSI -m 1 -l L -- "$TUNNEL_KEY" || true
+        printf '\n\n\n\n\n\n'
     fi
+    echo "ON THE RELAY ($RELAY), run this one command; the tunnel then comes up by itself:"
+    echo "    sudo deploy/relay.sh --key \"$TUNNEL_KEY\""
     echo "It will print this, and it must be the same:    $RELAY_PRINT"
     echo "The name $DOMAIN must lead to the relay."
 else

package/deploy/online.mjs

@@ -31,6 +31,7 @@ import { createInterface } from 'node:readline';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { readConf } from './updater.mjs';
+import { doctor, servedCert, DOCTOR_PATHS } from './doctor.mjs';
 
 export const PATHS = {
     access: '/var/lib/clavarium-relay-access',
@@ -40,6 +41,7 @@ export const PATHS = {
     unit: '/etc/systemd/system/clavarium.service',
     code: '/opt/clavarium',
     caddy: '/usr/local/bin/caddy',
+    passwords: '/run/clavarium-passwords',
 };
 export const STAGING = 'https://acme-staging-v02.api.letsencrypt.org/directory';
 const DOMAIN = /^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,24}$/;
@@ -81,9 +83,9 @@ export function parseOnline(args) {
         }
     }
     if (o.relay && o.port) throw new Bad('say how it will be reached: --relay HOST or --port, not both');
-    /* Neither: through a relay that does not exist yet -- its key is shown first,
-       and its address asked once the operator has made it with that key. */
-    if (!o.relay && !o.port) o.askRelay = true;
+    /* Neither: the usual case -- the domain points to the relay, which is
+       reached by the domain itself (its address is not needed). */
+    if (!o.relay && !o.port) o.relay = o.domain;
     if (!DOMAIN.test(o.domain)) throw new Bad('--domain is a host name, lower case, like clav.example.com');
     o.admin ||= `admin@${o.domain}`;
     if (!EMAIL.test(o.admin)) throw new Bad('--admin is an e-mail address, lower case');
@@ -123,24 +125,30 @@ export async function ensureKeys(sys, P = PATHS) {
     return { setup: read(f.setup), keeper: read(f.keeper), tunnel: read(f.tunnel) };
 }
 
+/* The QR code far from the key's text: with the text next to it, a phone may read
+   the TEXT (I/l/1 and case mixed up, the end cut off) instead of the code. */
+export const QR_WARNING = 'WARNING: read the QR code with the camera, not the text: some phones read the text on screen and get letters wrong, while the code is exact.';
 async function qr(sys, text) {
     const r = await sys.run(['qrencode', '-t', 'ANSI', '-m', '1', '-l', 'L', '--', text]);
-    if (r.code === 0 && r.out) sys.print(r.out.replace(/\n$/, ''));
+    if (r.code !== 0 || !r.out) return;
+    sys.print(QR_WARNING);
+    sys.print(r.out.replace(/\n$/, ''));
+    sys.print('\n\n\n\n\n');
 }
 
 /* `sudo clavarium key`: the public keys, as text and as QR codes for a phone. */
 export async function showKeys(sys, P = PATHS, { which = 'all' } = {}) {
     const keys = await ensureKeys(sys, P);
     if (which === 'all' || which === 'setup') {
+        await qr(sys, keys.setup);
         sys.print('SETUP KEY: for `clavarium online --relay`. Put it once on the relay, in');
         sys.print('~/.ssh/authorized_keys of an account that has sudo. It is taken out at the end.');
         sys.print(`    ${keys.setup}`);
-        await qr(sys, keys.setup);
     }
     if (which === 'all' || which === 'tunnel') {
+        await qr(sys, keys.tunnel);
         sys.print('TUNNEL KEY: only if you set up the relay yourself:');
         sys.print(`    sudo deploy/relay.sh --key "${keys.tunnel}"`);
-        await qr(sys, keys.tunnel);
     }
     sys.print('These are PUBLIC keys: showing them is safe.');
     return keys;
@@ -379,9 +387,9 @@ async function setUpRelay(sys, P, o, keys) {
     }
 
     sys.print('');
+    await qr(sys, keys.setup);
     sys.print(`1. Put this SETUP KEY on the relay, in ~${o.user}/.ssh/authorized_keys of ${o.relay}${o.user === 'root' ? '' : ` (${o.user} needs sudo without a password)`}:`);
     sys.print(`    ${keys.setup}`);
-    await qr(sys, keys.setup);
     sys.print('(A public key: safe to show. It is taken out again at the end.)');
     sys.print('');
     const deadline = sys.now() + WAIT_MS;
@@ -443,10 +451,22 @@ async function switchToServer(sys, P, o) {
     if (o.relay) argv.push('--relay', o.relay, '--relay-port', o.relayPort, '--relay-installed');
     sys.print('');
     sys.print('Switching to server mode: HTTPS, sign-in, the administrator...');
-    const r = await sys.run(argv, { stream: true, inherit: true });
+    const r = await sys.run(argv, { stream: true, inherit: true, env: { CLAVARIUM_PASSWORDS_TO: P.passwords } });
     if (r.code !== 0) throw new Failed(`the switch to server mode failed (exit ${r.code}, above: why)`);
 }
 
+/* The certificate: Caddy asks Let's Encrypt as it starts; a few minutes at most. */
+async function waitCertificate(sys, o) {
+    sys.print('');
+    sys.print(`Waiting for the certificate of ${o.domain} from Let's Encrypt (a few minutes at most)...`);
+    for (let i = 0; i < 18; i += 1) {
+        const c = await servedCert(sys, o.domain);
+        if (!c.none && c.verified && !c.local) { sys.print(`   obtained: ${c.issuer}`); return; }
+        await sys.sleep(10_000);
+    }
+    sys.print('   not yet: Caddy keeps asking by itself. The diagnosis below says why.');
+}
+
 /* `sudo clavarium online ...` */
 export async function online(o, sys, P = PATHS) {
     const was = serverModeOf(P);
@@ -478,10 +498,21 @@ export async function online(o, sys, P = PATHS) {
     } finally {
         tunnel?.proc.stop();
     }
-    await switchToServer(sys, P, o);
-    sys.print('');
-    sys.print(`Online: https://${o.domain}   (sign in as ${o.admin}, with the password above)`);
-    if (o.relay) sys.print('The relay is watched from here: sudo clavarium relay status');
+    try {
+        await switchToServer(sys, P, o);
+        await waitCertificate(sys, o);
+        await doctor(sys, {}, { ...DOCTOR_PATHS, unit: P.unit, relayConf: P.relayConf });
+        sys.print('');
+        sys.print(`Online: https://${o.domain}`);
+        if (o.relay) sys.print('The relay is watched from here: sudo clavarium relay status');
+        sys.print('Anything wrong later: sudo clavarium doctor (it says what to do; --fix repairs what it can)');
+        const pw = existsSync(P.passwords) ? readFileSync(P.passwords, 'utf8') : '';
+        sys.print('');
+        if (pw) {
+            sys.print('SIGN IN WITH (shown ONCE, kept nowhere in clear; lost: sudo clavarium password EMAIL):');
+            sys.print(pw.replace(/\n$/, ''));
+        } else sys.print(`Sign in as ${o.admin}, with its password (lost: sudo clavarium password ${o.admin}).`);
+    } finally { rmSync(P.passwords, { force: true }); }
 }
 
 /* `sudo clavarium relay VERB` */

package/deploy/updater.mjs

@@ -159,6 +159,8 @@ export class Updater {
     #save(change) {
         const state = { ...this.#state(), ...change, releases: this.releases().map(({ id, version, dataFormat, current }) => ({ id, version, dataFormat, current })) };
         state.version = this.current()?.version ?? null;
+        /* "Available" is only ever a version NEWER than the one that runs: once it runs, it is not offered again. */
+        if (state.available && (!VERSION.test(state.available) || (state.version && VERSION.test(state.version) && compareVersions(state.available, state.version) <= 0))) state.available = null;
         mkdirSync(this.#o.stateDir, { recursive: true, mode: 0o755 });
         const file = join(this.#o.stateDir, 'state.json');
         writeFileSync(`${file}.new`, `${JSON.stringify(state, null, 2)}\n`, { mode: 0o644 });
@@ -494,8 +496,12 @@ export class Updater {
         try { request = readFileSync(file, 'utf8').trim(); rmSync(file, { force: true }); } catch { /* none */ }
         const [verb, arg] = request.split(/\s+/);
         try {
-            if (verb === 'apply') return await this.apply(arg);
-            if (verb === 'rollback') return await this.rollback(arg);
+            /* Asked by the administrator: once done, the registry asked once more, so what is offered is what is true now. */
+            if (verb === 'apply' || verb === 'rollback') {
+                const r = verb === 'apply' ? await this.apply(arg) : await this.rollback(arg);
+                await this.check().catch(() => {});
+                return r;
+            }
             return await this.tick();
         } catch (error) {
             if (error instanceof Refused && request) this.#save({ refused: { at: this.#o.now().toISOString(), why: error.message } });

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "clavarium",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "clavarium",
-      "version": "0.1.0",
+      "version": "0.1.2",
       "license": "MIT",
       "dependencies": {
         "@xterm/addon-fit": "^0.11.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clavarium",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "license": "MIT",
   "type": "module",
   "description": "A conversation is a VM with a terminal in it. Everything else is a folder.",

package/server/updates.mjs

@@ -14,6 +14,7 @@
  */
 import { readFileSync, existsSync } from 'node:fs';
 import { Refusal } from './conversations.mjs';
+import { compareVersions } from '../deploy/updater.mjs';
 
 export const STATE_FILE = '/var/lib/clavarium/update/state.json';
 export const CONF_FILE = '/etc/clavarium/update.conf';
@@ -46,12 +47,15 @@ export class Updates {
     about() {
         if (!this.installed) return { installed: false, version: this.#version };
         const s = this.#read();
+        const version = s.version ?? this.#version;
+        /* Never offered: the version that runs, or an older one (a state written before it ran). */
+        const newer = VERSION.test(s.available ?? '') && !(VERSION.test(version ?? '') && compareVersions(s.available, version) <= 0);
         const releases = Array.isArray(s.releases) ? s.releases : [];
         return {
             installed: true,
-            version: s.version ?? this.#version,
+            version,
             ...this.#settings(),
-            available: VERSION.test(s.available ?? '') ? s.available : null,
+            available: newer ? s.available : null,
             checkedAt: s.checkedAt ?? null,
             checkError: s.checkError ?? null,
             running: s.running ?? null,