easy-devops 0.1.3 → 0.1.4

package/cli/managers/nginx-manager.js

@@ -268,7 +268,7 @@ async function installNginx() {
   let nginxVersion = FALLBACK_VERSION;
 
   const fetchVersionResult = await run(
-    `try { $p=(Invoke-WebRequest -Uri 'https://nginx.org/en/download.html' -UseBasicParsing -TimeoutSec 15).Content; if($p -match 'nginx-(\\d+\\.\\d+\\.\\d+)\\.zip'){$Matches[1]}else{''} } catch { '' }`,
+    `[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; try { $p=(Invoke-WebRequest -Uri 'https://nginx.org/en/download.html' -UseBasicParsing -TimeoutSec 15).Content; if($p -match 'nginx-(\\d+\\.\\d+\\.\\d+)\\.zip'){$Matches[1]}else{''} } catch { '' }`,
     { timeout: 20000 },
   );
   const fetched = (fetchVersionResult.stdout || '').trim();
@@ -276,15 +276,30 @@ async function installNginx() {
 
   const { nginxDir } = loadConfig();
   const zipUrl = `https://nginx.org/download/nginx-${nginxVersion}.zip`;
+  const zipDest = `$env:TEMP\\nginx-${nginxVersion}.zip`;
 
   spinner.text = `Downloading nginx ${nginxVersion}…`;
 
-  const downloadResult = await run(
-    `$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri '${zipUrl}' -OutFile "$env:TEMP\\nginx-${nginxVersion}.zip" -UseBasicParsing -TimeoutSec 120`,
+  // Try Invoke-WebRequest with TLS 1.2 forced, fall back to curl.exe
+  let downloadOk = false;
+  let downloadResult = await run(
+    `[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri '${zipUrl}' -OutFile "${zipDest}" -UseBasicParsing -TimeoutSec 120`,
     { timeout: 130000 },
   );
+  if (downloadResult.success) {
+    downloadOk = true;
+  } else {
+    const hasCurl = (await run('where.exe curl.exe 2>$null')).success;
+    if (hasCurl) {
+      downloadResult = await run(
+        `curl.exe -L --silent --show-error --max-time 120 -o "${zipDest}" "${zipUrl}"`,
+        { timeout: 130000 },
+      );
+      if (downloadResult.success) downloadOk = true;
+    }
+  }
 
-  if (!downloadResult.success) {
+  if (!downloadOk) {
     spinner.fail('Download failed');
     console.log(chalk.red(downloadResult.stderr || downloadResult.stdout));
     console.log(chalk.gray(`\n  Download nginx manually from: https://nginx.org/en/download.html\n`));

package/cli/managers/ssl-manager.js

@@ -276,29 +276,41 @@ async function installCertbot() {
     console.log(chalk.yellow('  Chocolatey failed, trying direct download...\n'));
   }
 
-  // 3. Direct download — try multiple sources in order
+  // 3. Direct download — try multiple sources × multiple download methods
+  //    PowerShell 5.1 on Windows Server defaults to TLS 1.0; GitHub requires TLS 1.2+.
+  //    Force TLS 1.2 before every Invoke-WebRequest call.
+  //    Also try curl.exe (built into Windows Server 2019+) as a second method.
   const INSTALLER_FILENAME = 'certbot-beta-installer-win_amd64_signed.exe';
+  const INSTALLER_DEST     = '$env:TEMP\\certbot-installer.exe';
   const downloadSources = [
     `https://github.com/certbot/certbot/releases/latest/download/${INSTALLER_FILENAME}`,
     `https://dl.eff.org/${INSTALLER_FILENAME}`,
   ];
 
+  const hasCurl = (await run('where.exe curl.exe 2>$null')).success;
+
   let downloaded = false;
   for (const url of downloadSources) {
     const label = new URL(url).hostname;
     console.log(chalk.gray(`\n  Downloading certbot installer from ${label} ...\n`));
 
-    const downloadResult = await run(
-      `$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri '${url}' -OutFile "$env:TEMP\\certbot-installer.exe" -UseBasicParsing -TimeoutSec 120`,
+    // Method A: Invoke-WebRequest with TLS 1.2 forced
+    const iwr = await run(
+      `[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri '${url}' -OutFile "${INSTALLER_DEST}" -UseBasicParsing -TimeoutSec 120`,
       { timeout: 130000 },
     );
+    if (iwr.success) { downloaded = true; break; }
 
-    if (downloadResult.success) {
-      downloaded = true;
-      break;
+    // Method B: curl.exe (handles TLS independently of PowerShell/.NET settings)
+    if (hasCurl) {
+      const curlResult = await run(
+        `curl.exe -L --silent --show-error --max-time 120 -o "${INSTALLER_DEST}" "${url}"`,
+        { timeout: 130000 },
+      );
+      if (curlResult.success) { downloaded = true; break; }
     }
 
-    console.log(chalk.yellow(`  Failed from ${label}: ${(downloadResult.stderr || downloadResult.stdout).split('\n')[0].trim()}`));
+    console.log(chalk.yellow(`  Failed from ${label}`));
   }
 
   if (!downloaded) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "easy-devops",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "A unified DevOps management tool with CLI and web dashboard for managing Nginx, SSL certificates, and Node.js on Linux and Windows servers.",
   "keywords": [
     "devops",