cyberia 3.2.22 → 3.2.70

package/src/cli/secrets.js

@@ -13,6 +13,58 @@ import { loggerFactory } from '../server/logger.js';
 
 const logger = loggerFactory(import.meta);
 
+// Shell/runtime-critical and Kubernetes-injected env keys that must never be persisted as
+// application secrets nor injected into a pod via `envFrom`. An injected PATH (or HOME, etc.)
+// overrides the container image's own and breaks coreutils/sudo resolution inside the pod
+// ("rm: command not found"). Single source of truth for both container-env capture and the
+// `underpost-config` secret built from an env file.
+const RESERVED_ENV_KEYS = new Set([
+  'HOME',
+  'HOSTNAME',
+  'PATH',
+  'TERM',
+  'SHLVL',
+  'PWD',
+  '_',
+  'LANG',
+  'LANGUAGE',
+  'LC_ALL',
+  'container',
+  'SHELL',
+  'USER',
+  'LOGNAME',
+  'MAIL',
+  'OLDPWD',
+  'LESSOPEN',
+  'LESSCLOSE',
+  'LS_COLORS',
+  'DISPLAY',
+  'COLORTERM',
+  'EDITOR',
+  'VISUAL',
+  'TERM_PROGRAM',
+  'TERM_PROGRAM_VERSION',
+  'SSH_AUTH_SOCK',
+  'SSH_CLIENT',
+  'SSH_CONNECTION',
+  'SSH_TTY',
+  'XDG_SESSION_ID',
+  'XDG_RUNTIME_DIR',
+  'XDG_DATA_DIRS',
+  'XDG_CONFIG_DIRS',
+  'DBUS_SESSION_BUS_ADDRESS',
+  'GPG_AGENT_INFO',
+  'WINDOWID',
+  'DESKTOP_SESSION',
+  'SESSION_MANAGER',
+  'XAUTHORITY',
+  'WAYLAND_DISPLAY',
+  'which_declare',
+]);
+const RESERVED_ENV_KEY_PREFIXES = ['KUBERNETES_', 'npm_', 'NODE_'];
+const isReservedEnvKey = (key) =>
+  RESERVED_ENV_KEYS.has(key) || RESERVED_ENV_KEY_PREFIXES.some((prefix) => key.startsWith(prefix));
+
 /**
  * @class UnderpostSecret
  * @description Manages the secrets of the application.
@@ -49,67 +101,49 @@ class UnderpostSecret {
        */
       createFromContainerEnv() {
         Underpost.env.clean();
-        const systemKeys = new Set([
-          'HOME',
-          'HOSTNAME',
-          'PATH',
-          'TERM',
-          'SHLVL',
-          'PWD',
-          '_',
-          'LANG',
-          'LANGUAGE',
-          'LC_ALL',
-          'container',
-          'SHELL',
-          'USER',
-          'LOGNAME',
-          'MAIL',
-          'OLDPWD',
-          'LESSOPEN',
-          'LESSCLOSE',
-          'LS_COLORS',
-          'DISPLAY',
-          'COLORTERM',
-          'EDITOR',
-          'VISUAL',
-          'TERM_PROGRAM',
-          'TERM_PROGRAM_VERSION',
-          'SSH_AUTH_SOCK',
-          'SSH_CLIENT',
-          'SSH_CONNECTION',
-          'SSH_TTY',
-          'XDG_SESSION_ID',
-          'XDG_RUNTIME_DIR',
-          'XDG_DATA_DIRS',
-          'XDG_CONFIG_DIRS',
-          'DBUS_SESSION_BUS_ADDRESS',
-          'GPG_AGENT_INFO',
-          'WINDOWID',
-          'DESKTOP_SESSION',
-          'SESSION_MANAGER',
-          'XAUTHORITY',
-          'WAYLAND_DISPLAY',
-          'which_declare',
-        ]);
-        const systemKeyPrefixes = ['KUBERNETES_', 'npm_', 'NODE_'];
         for (const [key, value] of Object.entries(process.env)) {
-          if (systemKeys.has(key)) continue;
-          if (systemKeyPrefixes.some((prefix) => key.startsWith(prefix))) continue;
+          if (isReservedEnvKey(key)) continue;
           Underpost.env.set(key, value);
         }
       },
     },
 
+    /**
+     * @method sanitizeSecretEnvFile
+     * @description Strips shell/runtime-critical and Kubernetes-injected keys (PATH, HOME, …) from
+     * raw `.env` file content so the resulting `underpost-config` secret can be safely injected via
+     * `envFrom` without clobbering the container image's own PATH. Blank lines and comments are
+     * preserved. Uses the same {@link RESERVED_ENV_KEYS} blocklist as container-env capture.
+     * @param {string} envFileContent - Raw contents of a `.env.<env>` file.
+     * @returns {string} Filtered env-file content.
+     * @memberof UnderpostSecret
+     */
+    sanitizeSecretEnvFile(envFileContent) {
+      return envFileContent
+        .split('\n')
+        .filter((line) => {
+          const trimmed = line.trimStart();
+          if (!trimmed || trimmed.startsWith('#')) return true;
+          const key = line.slice(0, line.indexOf('=')).trim();
+          return !key || !isReservedEnvKey(key);
+        })
+        .join('\n');
+    },
+
     /**
      * Removes all filesystem traces of secrets after deployment startup.
      * Centralizes the defense-in-depth cleanup performed
+     * @param {object} options - Options for cleaning the environment.
+     * @param {Array<string>} [options.keepKeys=[]] - List of keys to keep in the environment file. If provided, only these keys will be retained.
      * @memberof UnderpostSecret
      */
-    globalSecretClean() {
+    globalSecretClean(options = { keepKeys: [] }) {
+      const { keepKeys } = options;
       loadConf('clean');
       Underpost.repo.cleanupPrivateEngineRepo();
-      Underpost.env.clean();
+      Underpost.env.clean({
+        keepKeys: keepKeys.length > 0 ? keepKeys : ['container-status', 'start-container-status'],
+      });
     },
   };
 }

package/src/cli/ssh.js

@@ -496,6 +496,50 @@ EOF`);
       if (options.status) shellExec('service sshd status');
     },
 
+    /**
+     * Synchronously copies a local directory to a remote host over key-only SSH,
+     * streaming it as a tar archive (no intermediate file) and fixing ownership.
+     * Mirrors the kind-node `tar | docker cp` provisioning pattern but targets a
+     * real node via SSH, so node-local hostPath volumes can be materialized on the
+     * node where the pod will actually run.
+     *
+     * Idempotent and re-runnable: `mkdir -p` + `tar -x` overwrite in place. Throws
+     * on any SSH/tar failure so an empty-volume deploy is never produced silently.
+     *
+     * @function copyDirToNode
+     * @memberof UnderpostSSH
+     * @param {object} params
+     * @param {string} params.host - Target host/IP (key-only SSH reachable).
+     * @param {string} params.localDir - Local source directory.
+     * @param {string} params.remoteDir - Destination directory on the node.
+     * @param {number} [params.port=22] - SSH port.
+     * @param {string} [params.user='root'] - SSH user (key-only).
+     * @param {string} [params.keyPath='./engine-private/deploy/id_rsa'] - Private key path.
+     * @param {string} [params.owner='1000:1000'] - chown target on the node (empty to skip).
+     * @param {string} [params.mode='755'] - chmod mode on the node (empty to skip).
+     * @returns {void}
+     */
+    copyDirToNode: ({
+      host,
+      localDir,
+      remoteDir,
+      port = 22,
+      user = 'root',
+      keyPath = './engine-private/deploy/id_rsa',
+      owner = '1000:1000',
+      mode = '755',
+    }) => {
+      if (!host) throw new Error('copyDirToNode requires a host');
+      if (!localDir || !fs.existsSync(localDir)) throw new Error(`copyDirToNode: local dir not found: ${localDir}`);
+      if (!remoteDir) throw new Error('copyDirToNode requires a remoteDir');
+      shellExec(`chmod 600 ${keyPath}`, { silent: true, silentOnError: true, disableLog: true });
+      const sshOpts = `-i ${keyPath} -o BatchMode=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -p ${port}`;
+      shellExec(`ssh ${sshOpts} ${user}@${host} 'mkdir -p ${remoteDir}'`);
+      shellExec(`tar -C ${localDir} -c . | ssh ${sshOpts} ${user}@${host} 'tar -C ${remoteDir} -x'`);
+      const fixups = `${owner ? `chown -R ${owner} ${remoteDir}; ` : ''}${mode ? `chmod -R ${mode} ${remoteDir}` : ''}`.trim();
+      if (fixups) shellExec(`ssh ${sshOpts} ${user}@${host} '${fixups}'`);
+    },
+
     /**
      * Generic SSH remote command runner that SSH execution logic.
      * Executes arbitrary shell commands on a remote server via SSH with proper credential handling.
@@ -545,6 +589,196 @@ EOF
       return shellExec(sshScript, { stdout: true });
     },
 
+    /**
+     * Waits until a TCP SSH port becomes reachable on a host.
+     * @async
+     * @function waitForSshPort
+     * @memberof UnderpostSSH
+     * @param {object} params
+     * @param {string} params.host - Target host/IP.
+     * @param {number} [params.port=22] - SSH port.
+     * @param {number} [params.timeoutMs=600000] - Maximum wait window.
+     * @param {number} [params.intervalMs=3000] - Poll interval.
+     * @returns {Promise<boolean>} True once the port accepts connections, false on timeout.
+     */
+    waitForSshPort: async ({ host, port = 22, timeoutMs = 10 * 60 * 1000, intervalMs = 3000 }) => {
+      const deadline = Date.now() + timeoutMs;
+      while (Date.now() < deadline) {
+        const probe = shellExec(
+          `timeout 5 bash -c '</dev/tcp/${host}/${port}' >/dev/null 2>&1 && echo open || echo closed`,
+          { silent: true, stdout: true, silentOnError: true, disableLog: true },
+        );
+        if (`${probe}`.trim() === 'open') return true;
+        await new Promise((r) => setTimeout(r, intervalMs));
+      }
+      logger.warn(`SSH port ${host}:${port} not reachable within timeout`);
+      return false;
+    },
+
+    /**
+     * Waits until a host's SSH port stops accepting connections (e.g. while it
+     * reboots). Used to detect a reboot edge before waiting for the port to come
+     * back up, so callers don't latch onto the pre-reboot (ephemeral) sshd.
+     * @async
+     * @function waitForSshPortClosed
+     * @memberof UnderpostSSH
+     * @param {object} params
+     * @param {string} params.host - Target host/IP.
+     * @param {number} [params.port=22] - SSH port.
+     * @param {number} [params.timeoutMs=180000] - Maximum wait window.
+     * @param {number} [params.intervalMs=3000] - Poll interval.
+     * @returns {Promise<boolean>} True once the port is closed, false on timeout.
+     */
+    waitForSshPortClosed: async ({ host, port = 22, timeoutMs = 3 * 60 * 1000, intervalMs = 3000 }) => {
+      const deadline = Date.now() + timeoutMs;
+      while (Date.now() < deadline) {
+        const probe = shellExec(
+          `timeout 5 bash -c '</dev/tcp/${host}/${port}' >/dev/null 2>&1 && echo open || echo closed`,
+          { silent: true, stdout: true, silentOnError: true, disableLog: true },
+        );
+        if (`${probe}`.trim() === 'closed') return true;
+        await new Promise((r) => setTimeout(r, intervalMs));
+      }
+      return false;
+    },
+
+    /**
+     * Orchestrates a non-interactive, key-only SSH session against a freshly
+     * provisioned host: waits for the port, attempts key-based auth, runs a
+     * remote command batch, and returns a structured result. Used by the
+     * commissioning flow once the ephemeral runtime reports SSH readiness.
+     * @async
+     * @function sshExecBatch
+     * @memberof UnderpostSSH
+     * @param {object} params
+     * @param {string} params.host - Target host/IP.
+     * @param {string} params.command - Remote command batch to execute.
+     * @param {number} [params.port=22] - SSH port.
+     * @param {string} [params.user='root'] - SSH user (key-only).
+     * @param {string} [params.keyPath] - Private key path (defaults to engine deploy key).
+     * @param {number} [params.connectTimeoutSec=15] - Per-attempt SSH connect timeout.
+     * @param {number} [params.retries=3] - Auth/exec retry attempts.
+     * @param {number} [params.retryDelayMs=5000] - Base backoff between retries.
+     * @param {number} [params.waitForPortMs=0] - When > 0, wait for the port first.
+     * @returns {Promise<{ok: boolean, code: number, stdout: string, stderr: string, attempts: number}>}
+     */
+    sshExecBatch: async ({
+      host,
+      command,
+      port = 22,
+      user = 'root',
+      keyPath = './engine-private/deploy/id_rsa',
+      connectTimeoutSec = 15,
+      retries = 3,
+      retryDelayMs = 5000,
+      waitForPortMs = 0,
+    }) => {
+      if (!host) throw new Error('sshExecBatch requires a host');
+      if (!command) throw new Error('sshExecBatch requires a command');
+
+      if (waitForPortMs > 0) {
+        const reachable = await Underpost.ssh.waitForSshPort({ host, port, timeoutMs: waitForPortMs });
+        if (!reachable) return { ok: false, code: 255, stdout: '', stderr: 'ssh port unreachable', attempts: 0 };
+      }
+
+      shellExec(`chmod 600 ${keyPath}`, { silent: true, silentOnError: true, disableLog: true });
+
+      const sshOpts = [
+        `-i ${keyPath}`,
+        `-o BatchMode=yes`,
+        `-o PreferredAuthentications=publickey`,
+        `-o PubkeyAuthentication=yes`,
+        `-o PasswordAuthentication=no`,
+        `-o StrictHostKeyChecking=no`,
+        `-o UserKnownHostsFile=/dev/null`,
+        `-o ConnectTimeout=${connectTimeoutSec}`,
+        // Tolerate a freshly-booted node whose network briefly flaps (e.g. while
+        // NetworkManager applies a static profile): retry the TCP connect and
+        // keep the session alive across short stalls.
+        `-o ConnectionAttempts=3`,
+        `-o ServerAliveInterval=10`,
+        `-o ServerAliveCountMax=6`,
+        `-p ${port}`,
+      ].join(' ');
+
+      let last = { ok: false, code: 255, stdout: '', stderr: '', attempts: 0 };
+      for (let attempt = 1; attempt <= retries; attempt++) {
+        const result = shellExec(`ssh ${sshOpts} ${user}@${host} bash -s <<'UNDERPOST_SSH_BATCH_EOF'\n${command}\nUNDERPOST_SSH_BATCH_EOF`, {
+          stdout: false,
+          silentOnError: true,
+          disableLog: true,
+        });
+        last = {
+          ok: result.code === 0,
+          code: result.code,
+          stdout: result.stdout || '',
+          stderr: result.stderr || '',
+          attempts: attempt,
+        };
+        if (last.ok) {
+          logger.info(`sshExecBatch succeeded on ${user}@${host}:${port} (attempt ${attempt})`);
+          return last;
+        }
+        logger.warn(`sshExecBatch attempt ${attempt}/${retries} failed on ${user}@${host}:${port}`, {
+          code: last.code,
+          stderr: last.stderr.slice(-400),
+        });
+        if (attempt < retries) await new Promise((r) => setTimeout(r, retryDelayMs * attempt));
+      }
+      return last;
+    },
+
+    /**
+     * Transfers a local script to a remote host and runs it over key-only SSH.
+     * The script is base64-encoded so no shell-quoting/escaping is needed, then
+     * decoded, made executable, and executed with the given arguments. Reuses
+     * sshExecBatch for the actual transport, retries, and structured result.
+     * @async
+     * @function sshRunScript
+     * @memberof UnderpostSSH
+     * @param {object} params
+     * @param {string} params.host - Target host/IP.
+     * @param {string} params.scriptPath - Local path to the script to run.
+     * @param {string} [params.args=''] - Arguments appended to the remote invocation.
+     * @param {object} [params.env={}] - Environment variables exported for the remote run (e.g. secrets). Passed inline to the command, never echoed.
+     * @param {string} [params.remotePath='/tmp/underpost-remote-script.sh'] - Remote path to write the script.
+     * @param {number} [params.port=22] - SSH port.
+     * @param {string} [params.user='root'] - SSH user (key-only).
+     * @param {string} [params.keyPath] - Private key path (defaults to engine deploy key).
+     * @param {number} [params.retries=3] - Retry attempts.
+     * @param {number} [params.waitForPortMs=0] - When > 0, wait for the port first.
+     * @returns {Promise<{ok: boolean, code: number, stdout: string, stderr: string, attempts: number}>}
+     */
+    sshRunScript: async ({
+      host,
+      scriptPath,
+      args = '',
+      env = {},
+      remotePath = '/tmp/underpost-remote-script.sh',
+      port = 22,
+      user = 'root',
+      keyPath = './engine-private/deploy/id_rsa',
+      retries = 3,
+      waitForPortMs = 0,
+    }) => {
+      if (!fs.existsSync(scriptPath)) throw new Error(`sshRunScript: script not found: ${scriptPath}`);
+      const b64 = Buffer.from(fs.readFileSync(scriptPath, 'utf8'), 'utf8').toString('base64');
+      // Inline env assignments (single-quote escaped) so secrets are exported for
+      // the remote run without appearing as logged CLI args.
+      const sq = (v) => `'${String(v).replace(/'/g, "'\\''")}'`;
+      const envPrefix = Object.entries(env)
+        .filter(([, v]) => v !== undefined && v !== null && `${v}` !== '')
+        .map(([k, v]) => `${k}=${sq(v)}`)
+        .join(' ');
+      const command = [
+        'set -e',
+        `echo '${b64}' | base64 -d > ${remotePath}`,
+        `chmod +x ${remotePath}`,
+        `${envPrefix ? `${envPrefix} ` : ''}bash ${remotePath} ${args}`,
+      ].join('\n');
+      return Underpost.ssh.sshExecBatch({ host, port, user, keyPath, retries, waitForPortMs, command });
+    },
+
     /**
      * Loads saved SSH credentials from config and sets them in the UnderpostRootEnv API.
      * @async

package/src/cli/static.js

@@ -6,10 +6,10 @@
 import fs from 'fs-extra';
 import path from 'path';
 import express from 'express';
-import { ssrFactory } from '../server/ssr.js';
+import { ssrFactory } from '../client-builder/ssr.js';
 import { shellExec } from '../server/process.js';
 import Underpost from '../index.js';
-import { JSONweb } from '../server/client-formatted.js';
+import { JSONweb } from '../client-builder/client-formatted.js';
 import { loggerFactory, loggerMiddleware } from '../server/logger.js';
 const logger = loggerFactory(import.meta);
 /**