create-op-node 0.3.0 → 0.4.0

package/README.md

@@ -22,7 +22,40 @@ Then on the Mac Studio itself:
 npx create-op-node bootstrap
 ```
 
-Configures macOS power settings, installs Homebrew + the CLI tool list, sets up Docker Desktop + Tailscale + Ollama, clones the node repo you created, reads the pgsodium key + Tunnel token from the Studio's Keychain (or prompts you to paste them once, then persists for re-runs), writes the LaunchAgent plist, logs into ghcr.io, pulls + warms the LLM model, and finally `docker compose pull && up -d` brings the whole stack online. Health-check loop waits until all 10 containers are `(healthy)`.
+Configures macOS power settings, installs Homebrew + the CLI tool list, sets up Docker Desktop + Tailscale + Ollama, clones the node repo you created, reads the pgsodium key + Tunnel token from the Studio's Keychain (or prompts you to paste them once, then persists for re-runs), writes the LaunchAgent plist, logs into ghcr.io, pulls + warms the LLM model, and finally `docker compose --profile public pull && up -d` brings the whole stack online. Health-check loop waits until all containers are `(healthy)`.
+
+### Local-only mode (no Cloudflare)
+
+```bash
+npx create-op-node bootstrap --region us-ca --local-only
+```
+
+Brings the Studio up for local dev / testing — frontend on your laptop
+hits the Studio over Tailscale, no public exposure. Differences from
+the standard run:
+
+- **No Tunnel token required.** `init` is unnecessary; if the pgsodium
+  key isn't in Keychain, bootstrap generates one inline and persists it.
+- **`cloudflared` stays down.** It's gated behind the `public` compose
+  profile, which `--local-only` doesn't activate. Bootstrap also evicts
+  any leftover cloudflared from a prior public run so it doesn't strand
+  in `compose ps`.
+- **Backup stack skipped by default.** `docker-compose-backup.yml`
+  isn't loaded; pass `--compose-file docker-compose-backup.yml` to
+  include it explicitly.
+- **LaunchAgent omits `TUNNEL_TOKEN`.** Only `PGSODIUM_ROOT_KEY` is
+  exported into the launchd session.
+- **Outro tells you to use Tailscale**, not `npx create-op-node verify`.
+
+When you're ready to go public, re-run `bootstrap` without `--local-only`
+and the same Studio promotes to the full production-shaped deploy.
+
+> **Template version**: this mode depends on the `opuspopuli-node`
+> template having `profiles: [public]` on its cloudflared service. If
+> you cloned the template before that landed, refresh your fork
+> (or recreate from template) before using `--local-only` — otherwise
+> cloudflared starts regardless and will restart-loop without a
+> TUNNEL_TOKEN.
 
 > **Secret transport between laptop and Studio**
 >

package/dist/cli.js

@@ -1110,7 +1110,7 @@ async function writePgsodiumKeyFile(key, keyFile) {
   }
 }
 function renderLaunchAgentPlist(input) {
-  if (!TUNNEL_TOKEN_RE.test(input.tunnelToken)) {
+  if (input.tunnelToken !== void 0 && !TUNNEL_TOKEN_RE.test(input.tunnelToken)) {
     throw new Error("Tunnel token contains characters outside the expected base64-url set");
   }
   if (!SAFE_PATH_RE.test(input.keyFilePath)) {
@@ -1118,7 +1118,11 @@ function renderLaunchAgentPlist(input) {
       `keyFilePath ${JSON.stringify(input.keyFilePath)} contains characters not allowed in a launchd path interpolation`
     );
   }
-  const command = `launchctl setenv PGSODIUM_ROOT_KEY "$(cat ${input.keyFilePath})"; launchctl setenv TUNNEL_TOKEN "${input.tunnelToken}"`;
+  const setenvLines = [
+    `launchctl setenv PGSODIUM_ROOT_KEY "$(cat ${input.keyFilePath})"`,
+    ...input.tunnelToken !== void 0 ? [`launchctl setenv TUNNEL_TOKEN "${input.tunnelToken}"`] : []
+  ];
+  const command = setenvLines.join("; ");
   return [
     '<?xml version="1.0" encoding="UTF-8"?>',
     '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
@@ -1171,7 +1175,7 @@ async function setupLaunchAgent(input) {
   try {
     plistContent = renderLaunchAgentPlist({
       keyFilePath: paths.keyFile,
-      tunnelToken: input.tunnelToken
+      ...input.tunnelToken !== void 0 ? { tunnelToken: input.tunnelToken } : {}
     });
   } catch (err) {
     return { ok: false, paths, step: "plist", reason: err.message };
@@ -1254,7 +1258,8 @@ async function loginToGhcr() {
 function composeArgs(opts, sub) {
   const files = opts.files.flatMap((f) => ["-f", f]);
   const env = opts.envFile ? ["--env-file", opts.envFile] : [];
-  return ["compose", ...files, ...env, ...sub];
+  const profiles = (opts.profiles ?? []).flatMap((pr) => ["--profile", pr]);
+  return ["compose", ...files, ...env, ...profiles, ...sub];
 }
 async function composePull(opts) {
   const res = await safeExeca("docker", composeArgs(opts, ["pull"]));
@@ -1264,6 +1269,10 @@ async function composeUp(opts) {
   const res = await safeExeca("docker", composeArgs(opts, ["up", "-d", "--remove-orphans"]));
   return result(res, "compose up");
 }
+async function composeRemoveService(opts, service) {
+  const res = await safeExeca("docker", composeArgs(opts, ["rm", "-sfv", service]));
+  return result(res, `compose rm ${service}`);
+}
 async function composeDown(opts) {
   const flags = ["down"];
   if (opts.wipeVolumes) flags.push("-v");
@@ -1543,19 +1552,26 @@ async function locateOrCloneRepo(input) {
 }
 
 // src/commands/bootstrap.ts
+var PUBLIC_PROFILES = ["public"];
+var LOCAL_PROFILES = [];
 var bootstrapCommand = new Command("bootstrap").description(
   "Configure the Mac Studio and bring the stack up. Run this on the Studio itself, after `init` has finished on your laptop."
 ).addOption(new Option("--region <slug>", "Region label set during init (e.g. us-ca)")).addOption(new Option("--owner <owner>", "GitHub owner for the node repo").default("OpusPopuli")).addOption(new Option("--repo-dir <path>", "Explicit path to a checked-out node repo (overrides cwd + clone)")).addOption(
   new Option(
     "--compose-file <path>",
-    "Repeatable. Compose file relative to repo root. Default: docker-compose-prod.yml + docker-compose-backup.yml"
-  ).default(["docker-compose-prod.yml", "docker-compose-backup.yml"])
+    "Repeatable. Compose file relative to repo root. Default: prod + backup (production), prod only (--local-only)."
+  )
 ).addOption(new Option("--env-file <path>", "Compose --env-file. Default: .env.production")).addOption(new Option("--skip-brew", "Skip the Homebrew package install pass").default(false)).addOption(
   new Option(
     "--skip-launch-agent",
     "Skip the LaunchAgent setup (assumes one is already in place)"
   ).default(false)
-).addOption(new Option("--skip-ollama", "Skip the Ollama model pull + warm").default(false)).addOption(new Option("--skip-stack", "Stop before `docker compose pull && up`").default(false)).addOption(new Option("-y, --yes", "Skip confirmation prompts").default(false)).action(async (opts) => {
+).addOption(new Option("--skip-ollama", "Skip the Ollama model pull + warm").default(false)).addOption(new Option("--skip-stack", "Stop before `docker compose pull && up`").default(false)).addOption(
+  new Option(
+    "--local-only",
+    "Run for local dev / testing: no Tunnel token required, cloudflared stays down. Auto-generates the pgsodium key if not in Keychain (init unnecessary)."
+  ).default(false)
+).addOption(new Option("-y, --yes", "Skip confirmation prompts").default(false)).action(async (opts) => {
   p3.intro(pc2.bgCyan(pc2.black(" create-op-node bootstrap ")));
   const region = opts.region ? opts.region : unwrap(
     await p3.text({
@@ -1566,6 +1582,8 @@ var bootstrapCommand = new Command("bootstrap").description(
   );
   const owner = opts.owner ?? "OpusPopuli";
   const repoName = `opuspopuli-node-${region}`;
+  const composeFileDefault = opts.localOnly ? ["docker-compose-prod.yml"] : ["docker-compose-prod.yml", "docker-compose-backup.yml"];
+  const composeFile = opts.composeFile ?? composeFileDefault;
   const sysSpin = p3.spinner();
   sysSpin.start("Inspecting macOS\u2026");
   const snap = await inspectSystem();
@@ -1682,14 +1700,14 @@ var bootstrapCommand = new Command("bootstrap").description(
     );
     process.exit(1);
   }
-  const pgsodiumKey = await loadOrPromptSecret({
+  const pgsodiumKey = await loadSecret({
     region,
     account: "pgsodium-root-key",
     label: "pgsodium master key",
-    placeholder: "64 lowercase hex characters",
-    validate: (v) => PGSODIUM_KEY_RE.test(v) ? void 0 : "must be exactly 64 lowercase hex characters"
+    validate: (v) => PGSODIUM_KEY_RE.test(v) ? void 0 : "must be exactly 64 lowercase hex characters",
+    ...opts.localOnly ? { generate: generatePgsodiumRootKey } : {}
   });
-  const tunnelToken = await loadOrPromptSecret({
+  const tunnelToken = opts.localOnly ? void 0 : await loadSecret({
     region,
     account: "tunnel-token",
     label: "Cloudflare Tunnel token",
@@ -1699,13 +1717,20 @@ var bootstrapCommand = new Command("bootstrap").description(
   if (!opts.skipLaunchAgent) {
     const laSpin = p3.spinner();
     laSpin.start("Writing pgsodium key file + LaunchAgent plist\u2026");
-    const la = await setupLaunchAgent({ pgsodiumKey, tunnelToken });
+    const la = await setupLaunchAgent({
+      pgsodiumKey,
+      ...tunnelToken !== void 0 ? { tunnelToken } : {}
+    });
     if (!la.ok) {
       laSpin.stop(pc2.red(`\u2717 LaunchAgent step ${la.step} failed.`));
       p3.cancel(la.reason ?? "LaunchAgent setup failed.");
       process.exit(1);
     }
-    laSpin.stop(pc2.green(`\u2713 LaunchAgent loaded (${la.paths.plistFile}).`));
+    laSpin.stop(
+      pc2.green(
+        `\u2713 LaunchAgent loaded (${la.paths.plistFile})${opts.localOnly ? " \u2014 local-only mode, no TUNNEL_TOKEN set" : ""}.`
+      )
+    );
   }
   const ghcrSpin = p3.spinner();
   ghcrSpin.start("Authenticating Docker to ghcr.io\u2026");
@@ -1756,19 +1781,32 @@ var bootstrapCommand = new Command("bootstrap").description(
     }
   }
   if (opts.skipStack) {
+    const profileFlag = opts.localOnly ? "" : "--profile public ";
     p3.outro(
       pc2.cyan(
-        `Stack-up skipped. Run \`docker compose -f ${(opts.composeFile ?? ["docker-compose-prod.yml"]).join(" -f ")} pull && up -d\` from ${repoPath} when ready.`
+        `Stack-up skipped. Run \`docker compose -f ${composeFile.join(" -f ")} ${profileFlag}pull && docker compose -f ${composeFile.join(" -f ")} ${profileFlag}up -d\` from ${repoPath} when ready.`
       )
     );
     return;
   }
-  const composeFiles = resolveComposeFiles(repoPath, opts.composeFile);
+  const composeFiles = resolveComposeFiles(repoPath, composeFile);
   const composeOpts = {
     files: composeFiles,
     cwd: repoPath,
-    ...opts.envFile ? { envFile: opts.envFile } : {}
+    ...opts.envFile ? { envFile: opts.envFile } : {},
+    profiles: opts.localOnly ? LOCAL_PROFILES : PUBLIC_PROFILES
   };
+  if (opts.localOnly) {
+    const evict = p3.spinner();
+    evict.start("Evicting any cloudflared from a prior public bootstrap\u2026");
+    const rm2 = await composeRemoveService(
+      { ...composeOpts, profiles: PUBLIC_PROFILES },
+      "cloudflared"
+    );
+    evict.stop(
+      rm2.ok ? pc2.green("\u2713 cloudflared not present (or removed).") : pc2.yellow(`\u26A0 cloudflared eviction reported: ${rm2.reason ?? "unknown"} \u2014 continuing.`)
+    );
+  }
   const pullSpin = p3.spinner();
   pullSpin.start("Pulling images from ghcr.io\u2026");
   const pull = await composePull(composeOpts);
@@ -1799,11 +1837,23 @@ var bootstrapCommand = new Command("bootstrap").description(
   switch (outcome.kind) {
     case "healthy":
       healthSpin.stop(pc2.green(`\u2713 All ${outcome.snapshots.length} containers healthy.`));
-      p3.outro(
-        pc2.cyan(
-          `Region ${region} is up. Next: verify off-LAN with \`npx create-op-node verify --domain <your-domain>\`.`
-        )
-      );
+      if (opts.localOnly) {
+        p3.outro(
+          pc2.cyan(
+            [
+              `Region ${region} is up locally (no public Cloudflare Tunnel \u2014 cloudflared stays down).`,
+              `Access from your laptop over Tailscale at this Studio's tailnet IP.`,
+              `When you're ready to expose publicly, re-run \`bootstrap\` without --local-only.`
+            ].join("\n")
+          )
+        );
+      } else {
+        p3.outro(
+          pc2.cyan(
+            `Region ${region} is up. Next: verify off-LAN with \`npx create-op-node verify --domain <your-domain>\`.`
+          )
+        );
+      }
       return;
     case "unhealthy":
       healthSpin.stop(pc2.red(`\u2717 ${outcome.problem}`));
@@ -1930,7 +1980,7 @@ async function promptTailscaleSignin() {
   );
   unwrap(await p3.confirm({ message: "Tailscale signed in (or skipped)?", initialValue: true }));
 }
-async function loadOrPromptSecret(input) {
+async function loadSecret(input) {
   const coords = { region: input.region, account: input.account };
   const spin = p3.spinner();
   spin.start(`Reading ${input.label} from Keychain\u2026`);
@@ -1940,8 +1990,20 @@ async function loadOrPromptSecret(input) {
     return existing;
   }
   spin.stop(
-    existing ? pc2.yellow(`\u26A0 ${input.label} in Keychain failed validation \u2014 will re-prompt.`) : pc2.dim(`\xB7 ${input.label} not in Keychain \u2014 will prompt.`)
+    existing ? pc2.yellow(`\u26A0 ${input.label} in Keychain failed format validation \u2014 will replace.`) : pc2.dim(`\xB7 ${input.label} not in Keychain.`)
   );
+  if (input.generate) {
+    const fresh = input.generate();
+    const save2 = await saveSecret(coords, fresh);
+    if (!save2.written) {
+      p3.cancel(
+        `Generated a fresh ${input.label} but couldn't persist it to Keychain: ${save2.reason ?? "unknown"}. Continuing would risk silent key rotation on the next re-run. Resolve the Keychain access (re-grant via Keychain Access.app or check the security CLI) and re-run.`
+      );
+      process.exit(1);
+    }
+    p3.note(`${pc2.green("\u2713")} Generated fresh ${input.label} and stored in Keychain.`, "Keychain");
+    return fresh;
+  }
   const pasted = unwrap(
     await p3.password({
       message: `Paste the ${input.label} for region ${input.region}:`,
@@ -1950,7 +2012,10 @@ async function loadOrPromptSecret(input) {
   );
   const save = await saveSecret(coords, pasted);
   if (!save.written) {
-    p3.note(`${pc2.yellow("\u26A0")} Couldn't persist to Keychain: ${save.reason ?? "unknown"}. Continuing anyway.`, "Keychain");
+    p3.note(
+      `${pc2.yellow("\u26A0")} Couldn't persist to Keychain: ${save.reason ?? "unknown"}. You'll need to paste it again next run.`,
+      "Keychain"
+    );
   } else {
     p3.note(`${pc2.green("\u2713")} Stored ${input.label} in Keychain for re-runs.`, "Keychain");
   }
@@ -3663,7 +3728,7 @@ async function looksLikeRegionsRepo(dir) {
 }
 
 // src/cli.ts
-var VERSION = "0.3.0";
+var VERSION = "0.4.0";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."