create-op-node 0.11.3 → 0.12.0

package/dist/cli.js

@@ -20,6 +20,10 @@ var SAFE_PATH_RE = /^[A-Za-z0-9_\-./ ]+$/;
 var SAFE_LAUNCHCTL_VALUE_RE = /^[A-Za-z0-9+/=._-]+$/;
 var URL_SAFE_PASSWORD_RE = /^[A-Za-z0-9_-]+$/;
 var SAFE_URL_RE = /^[A-Za-z0-9:/_.-]+$/;
+var WELL_KNOWN_GATEWAY_HMAC_SECRET = (
+  // eslint-disable-next-line sonarjs/hardcoded-secret-signatures, sonarjs/no-hardcoded-passwords -- this is the PUBLIC well-known template default we are guarding AGAINST, not a live credential
+  "local-only-hmac-secret-rotate-before-tunnel-exposure"
+);
 var VERIFY_NETWORK_TIMEOUT_MS = 1e4;
 var API_REQUEST_TIMEOUT_MS = 15e3;
 var BODY_PREVIEW_MAX = 200;
@@ -296,7 +300,9 @@ var FRIENDLY = {
   "dashboard-password": "Supabase Studio dashboard password",
   "prompts-db-password": "prompt-service Postgres password",
   "prompt-service-api-key": "prompt-service HMAC API key",
-  "prompt-service-admin-api-key": "prompt-service admin API key"
+  "prompt-service-admin-api-key": "prompt-service admin API key",
+  "gateway-hmac-secret": "API Gateway HMAC secret",
+  "grafana-admin-password": "Grafana admin password"
 };
 function labelFor(coords) {
   return `Opus Populi (${coords.region}) \u2014 ${FRIENDLY[coords.account]}`;
@@ -590,6 +596,15 @@ function generateDashboardPassword() {
 function generateHmacApiKey() {
   return base64url(randomBytes(32));
 }
+function generateGatewayHmacSecret() {
+  return base64url(randomBytes(32));
+}
+function renderApiKeys(gatewayHmacSecret) {
+  return JSON.stringify({ "api-gateway": gatewayHmacSecret });
+}
+function generateGrafanaAdminPassword() {
+  return base64url(randomBytes(24));
+}
 function generateJwtSecret() {
   return randomBytes(48).toString("base64");
 }
@@ -1520,7 +1535,9 @@ function validatePlistInput(input) {
     ["jwtSecret", input.jwtSecret],
     ["supabaseAnonKey", input.supabaseAnonKey],
     ["supabaseServiceRoleKey", input.supabaseServiceRoleKey],
-    ["dashboardPassword", input.dashboardPassword]
+    ["dashboardPassword", input.dashboardPassword],
+    ["gatewayHmacSecret", input.gatewayHmacSecret],
+    ["grafanaAdminPassword", input.grafanaAdminPassword]
   ];
   for (const [name, value] of supabaseFields) {
     if (value !== void 0 && !SAFE_LAUNCHCTL_VALUE_RE.test(value)) {
@@ -1548,6 +1565,8 @@ function buildSetenvCommand(input) {
     ...input.supabaseAnonKey !== void 0 ? [`launchctl setenv SUPABASE_ANON_KEY "${input.supabaseAnonKey}"`] : [],
     ...input.supabaseServiceRoleKey !== void 0 ? [`launchctl setenv SUPABASE_SERVICE_ROLE_KEY "${input.supabaseServiceRoleKey}"`] : [],
     ...input.dashboardPassword !== void 0 ? [`launchctl setenv DASHBOARD_PASSWORD "${input.dashboardPassword}"`] : [],
+    ...input.gatewayHmacSecret !== void 0 ? [`launchctl setenv GATEWAY_HMAC_SECRET "${input.gatewayHmacSecret}"`] : [],
+    ...input.grafanaAdminPassword !== void 0 ? [`launchctl setenv GRAFANA_ADMIN_PASSWORD "${input.grafanaAdminPassword}"`] : [],
     ...input.supabaseUrl !== void 0 ? [`launchctl setenv SUPABASE_URL "${input.supabaseUrl}"`] : []
   ].join("; ");
 }
@@ -1586,6 +1605,8 @@ function plistInputFromSetup(input, keyFilePath) {
     ...input.supabaseAnonKey !== void 0 ? { supabaseAnonKey: input.supabaseAnonKey } : {},
     ...input.supabaseServiceRoleKey !== void 0 ? { supabaseServiceRoleKey: input.supabaseServiceRoleKey } : {},
     ...input.dashboardPassword !== void 0 ? { dashboardPassword: input.dashboardPassword } : {},
+    ...input.gatewayHmacSecret !== void 0 ? { gatewayHmacSecret: input.gatewayHmacSecret } : {},
+    ...input.grafanaAdminPassword !== void 0 ? { grafanaAdminPassword: input.grafanaAdminPassword } : {},
     ...input.supabaseUrl !== void 0 ? { supabaseUrl: input.supabaseUrl } : {}
   };
 }
@@ -1755,6 +1776,19 @@ export SUPABASE_ANON_KEY="$(require_secret supabase-anon-key)"
 export SUPABASE_SERVICE_ROLE_KEY="$(require_secret supabase-service-role-key)"
 export DASHBOARD_PASSWORD="$(require_secret dashboard-password)"
 
+# API Gateway HMAC secret. The gateway signs gateway\u2192microservice requests
+# with this (X-HMAC-Auth) in EVERY mode, so it is required. API_KEYS is the
+# JSON map each microservice reads to verify the caller; the api-gateway's
+# key MUST equal GATEWAY_HMAC_SECRET. We render the JSON from the single
+# Keychain value here so the compose \`\${GATEWAY_HMAC_SECRET:-\u2026}\` /
+# \`\${API_KEYS:-\u2026}\` well-known defaults are always overridden with a real
+# per-node value.
+export GATEWAY_HMAC_SECRET="$(require_secret gateway-hmac-secret)"
+export API_KEYS="{\\"api-gateway\\":\\"\${GATEWAY_HMAC_SECRET}\\"}"
+
+# Grafana admin password \u2014 overrides the compose \`admin\`/\`admin\` default.
+export GRAFANA_ADMIN_PASSWORD="$(require_secret grafana-admin-password)"
+
 # AUTH_JWT_SECRET historically equals JWT_SECRET in dev/UAT \u2014 supply that
 # default if the operator hasn't set one independently.
 export AUTH_JWT_SECRET="\${AUTH_JWT_SECRET:-$JWT_SECRET}"
@@ -2551,6 +2585,22 @@ async function collectCoreSecrets(args) {
     validate: (v) => URL_SAFE_PASSWORD_RE.test(v) ? void 0 : "must be base64url chars only (no + / =)",
     generate: generateDashboardPassword
   });
+  const gatewayHmacSecret = await loadSecret({
+    region,
+    account: "gateway-hmac-secret",
+    label: "API Gateway HMAC secret",
+    validate: (v) => URL_SAFE_PASSWORD_RE.test(v) && v !== WELL_KNOWN_GATEWAY_HMAC_SECRET ? void 0 : "must be base64url chars only (no + / =) and not the well-known template default",
+    generate: generateGatewayHmacSecret
+  });
+  const grafanaAdminPassword = await loadSecret({
+    region,
+    account: "grafana-admin-password",
+    label: "Grafana admin password",
+    // URL-safe alphabet — exported into the compose env for Grafana's
+    // GF_SECURITY_ADMIN_PASSWORD; keep it free of shell/URL metacharacters.
+    validate: (v) => URL_SAFE_PASSWORD_RE.test(v) ? void 0 : "must be base64url chars only (no + / =)",
+    generate: generateGrafanaAdminPassword
+  });
   return {
     pgsodiumKey,
     tunnelToken,
@@ -2558,7 +2608,9 @@ async function collectCoreSecrets(args) {
     jwtSecret,
     supabaseAnonKey,
     supabaseServiceRoleKey,
-    dashboardPassword
+    dashboardPassword,
+    gatewayHmacSecret,
+    grafanaAdminPassword
   };
 }
 async function collectPromptServiceSecrets(args) {
@@ -2655,6 +2707,8 @@ async function runLaunchAgentPhase(args) {
     supabaseAnonKey: secrets.supabaseAnonKey,
     supabaseServiceRoleKey: secrets.supabaseServiceRoleKey,
     dashboardPassword: secrets.dashboardPassword,
+    gatewayHmacSecret: secrets.gatewayHmacSecret,
+    grafanaAdminPassword: secrets.grafanaAdminPassword,
     supabaseUrl: secrets.supabaseUrl
   });
   if (!la.ok) {
@@ -2741,6 +2795,14 @@ function buildComposeEnv(args) {
     SUPABASE_ANON_KEY: secrets.supabaseAnonKey,
     SUPABASE_SERVICE_ROLE_KEY: secrets.supabaseServiceRoleKey,
     DASHBOARD_PASSWORD: secrets.dashboardPassword,
+    // Real per-node gateway HMAC secret + the derived API_KEYS map. These
+    // override the template's well-known `${GATEWAY_HMAC_SECRET:-…}` /
+    // `${API_KEYS:-…}` compose defaults so a Tunnel-exposed node never signs
+    // with the shared placeholder. The api-gateway's key MUST equal
+    // GATEWAY_HMAC_SECRET, which renderApiKeys guarantees.
+    GATEWAY_HMAC_SECRET: secrets.gatewayHmacSecret,
+    API_KEYS: renderApiKeys(secrets.gatewayHmacSecret),
+    GRAFANA_ADMIN_PASSWORD: secrets.grafanaAdminPassword,
     SUPABASE_URL: secrets.supabaseUrl,
     AUTH_JWT_SECRET: process.env["AUTH_JWT_SECRET"] ?? secrets.jwtSecret,
     ...secrets.tunnelToken !== void 0 ? { TUNNEL_TOKEN: secrets.tunnelToken } : {},
@@ -2748,6 +2810,26 @@ function buildComposeEnv(args) {
     ...embeddingModel ? { EMBEDDINGS_MODEL: embeddingModel } : {}
   };
 }
+function checkPublicProfileSecrets(env) {
+  const gateway = env["GATEWAY_HMAC_SECRET"];
+  const apiKeys = env["API_KEYS"];
+  const bad = (v) => v === void 0 || v.length === 0 || v.includes(WELL_KNOWN_GATEWAY_HMAC_SECRET);
+  if (bad(gateway) || bad(apiKeys)) {
+    return {
+      ok: false,
+      reason: "Refusing to expose this node via the Cloudflare Tunnel (public profile) with the well-known GATEWAY_HMAC_SECRET / API_KEYS default. Every copy of the template ships the same placeholder value \u2014 a Tunnel-exposed gateway signed with it is trivially forgeable. Re-run `create-op-node bootstrap` so it generates a real per-node secret (or use `--local-only` to run without the public profile)."
+    };
+  }
+  return { ok: true };
+}
+function enforcePublicProfileSecrets(args) {
+  if (args.localOnly) return;
+  const verdict = checkPublicProfileSecrets(args.env);
+  if (!verdict.ok) {
+    p3.cancel(verdict.reason);
+    process.exit(1);
+  }
+}
 function planSignatureGate(allImages, opts) {
   if (opts.skipSignatureCheck) return { kind: "skip" };
   if (allImages === null) return { kind: "enumerate-failed" };
@@ -2824,6 +2906,7 @@ async function runStackPhase(args) {
     profiles: opts.localOnly ? LOCAL_PROFILES : PUBLIC_PROFILES,
     env: composeEnv
   };
+  enforcePublicProfileSecrets({ localOnly: Boolean(opts.localOnly), env: composeEnv });
   if (opts.localOnly) {
     const evict = p3.spinner();
     evict.start("Evicting any cloudflared from a prior public bootstrap\u2026");
@@ -5004,7 +5087,7 @@ function withDefaultSubcommand(argv, known) {
 }
 
 // src/cli.ts
-var VERSION = "0.11.3";
+var VERSION = "0.12.0";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."