easy-vps 0.1.0

package/dist/services/database.js

@@ -0,0 +1,540 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startPooler = startPooler;
+exports.list = list;
+exports.createDatabase = createDatabase;
+exports.removeDatabase = removeDatabase;
+exports.backup = backup;
+exports.restore = restore;
+exports.downloadDump = downloadDump;
+exports.backupToS3 = backupToS3;
+exports.backupStream = backupStream;
+exports.readBackupFromS3 = readBackupFromS3;
+exports.listBackupsFromS3 = listBackupsFromS3;
+exports.restoreFromS3 = restoreFromS3;
+// Database management via Docker containers on the managed VPS.
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = __importDefault(require("node:path"));
+const ssh_1 = require("./ssh");
+const backup_config_1 = require("./backup-config");
+const s3_1 = require("./s3");
+const ENGINE_IMAGE = {
+    postgres: 'postgres:16-alpine',
+    mysql: 'mysql:8',
+    mongodb: 'mongo:7',
+};
+const ENGINE_ENV = {
+    postgres: (c) => [
+        `-e POSTGRES_USER=${(0, ssh_1.quote)(c.user)}`,
+        `-e POSTGRES_PASSWORD=${(0, ssh_1.quote)(c.password)}`,
+    ],
+    mysql: (c) => [
+        `-e MYSQL_ROOT_PASSWORD=${(0, ssh_1.quote)(c.password)}`,
+        `-e MYSQL_USER=${(0, ssh_1.quote)(c.user)}`,
+        `-e MYSQL_PASSWORD=${(0, ssh_1.quote)(c.password)}`,
+    ],
+    mongodb: (c) => [
+        `-e MONGO_INITDB_ROOT_USERNAME=${(0, ssh_1.quote)(c.user)}`,
+        `-e MONGO_INITDB_ROOT_PASSWORD=${(0, ssh_1.quote)(c.password)}`,
+    ],
+};
+const LABEL = 'easy-vps=database';
+/** Default internal port inside the container for each engine. */
+const INTERNAL_PORT = {
+    postgres: 5432,
+    mysql: 3306,
+    mongodb: 27017,
+};
+/** Internal listen port for the connection pooler of each engine (0 = none). */
+const POOLED_INTERNAL_PORT = {
+    postgres: 6432,
+    mysql: 6033,
+    mongodb: 0,
+};
+/** Docker image used for the connection pooler of each engine. */
+const POOLER_IMAGE = {
+    postgres: 'pgbouncer/pgbouncer:latest',
+    mysql: 'proxysql/proxysql:latest',
+};
+const POOLER_LABEL = 'easy-vps=pooler';
+/** Config files (written to the VPS) for a database's pooler container. */
+function poolerConfigFiles(engine, config) {
+    if (engine === 'postgres') {
+        const userlist = `"${config.user}" "${config.password}"\n`;
+        const clientCap = Math.max(100, config.poolSize * 10);
+        const ini = [
+            '[databases]',
+            `${config.name} = host=${config.name} port=5432 dbname=${config.name}`,
+            '',
+            '[pgbouncer]',
+            'listen_addr = 0.0.0.0',
+            'listen_port = 6432',
+            'auth_type = md5',
+            'auth_file = /etc/pgbouncer/userlist.txt',
+            'pool_mode = transaction',
+            `max_client_conn = ${clientCap}`,
+            `default_pool_size = ${config.poolSize}`,
+            `max_user_connections = ${config.poolSize}`,
+            '',
+        ].join('\n');
+        return [
+            { remote: `/tmp/${config.name}-pgbouncer.ini`, content: ini, mount: '/etc/pgbouncer/pgbouncer.ini' },
+            { remote: `/tmp/${config.name}-userlist.txt`, content: userlist, mount: '/etc/pgbouncer/userlist.txt' },
+        ];
+    }
+    if (engine === 'mysql') {
+        const clientCap = Math.max(100, config.poolSize * 10);
+        const cnf = [
+            'datadir="/var/lib/proxysql"',
+            'admin_variables=',
+            '{',
+            '  admin_credentials="admin:admin"',
+            '  mysql_ifaces="0.0.0.0:6032"',
+            '}',
+            'mysql_variables=',
+            '{',
+            '  interfaces="0.0.0.0:6033"',
+            '  default_schema="mysql"',
+            `  max_connections = ${clientCap}`,
+            '}',
+            'mysql_servers=',
+            '(',
+            `  { address="${config.name}", port=3306, hostgroup=0 }`,
+            ')',
+            'mysql_users=',
+            '(',
+            `  { username="${config.user}", password="${config.password}", default_hostgroup=0, max_connections=${config.poolSize} }`,
+            ')',
+            '',
+        ].join('\n');
+        return [{ remote: `/tmp/${config.name}-proxysql.cnf`, content: cnf, mount: '/etc/proxysql.cnf' }];
+    }
+    return null;
+}
+/** Start the pooler sidecar for an engine that has one. Returns the host port, or 0. */
+async function startPooler(remote, config) {
+    const internal = POOLED_INTERNAL_PORT[config.engine];
+    const image = POOLER_IMAGE[config.engine];
+    if (!internal || !image)
+        return 0;
+    await remote.exec((0, ssh_1.loginShell)(`docker rm -f ${(0, ssh_1.quote)(config.name)}-pooler >/dev/null 2>&1 || true`), 10_000);
+    const files = poolerConfigFiles(config.engine, config);
+    if (!files)
+        return 0;
+    for (const file of files)
+        await remote.writeFile(file.remote, file.content);
+    const pooledHostPort = await findPort(remote, internal);
+    const mounts = files.map((f) => `-v ${(0, ssh_1.quote)(f.remote)}:${(0, ssh_1.quote)(f.mount)}`).join(' ');
+    const poolerCmd = [
+        'docker run -d',
+        `--name ${(0, ssh_1.quote)(config.name)}-pooler`,
+        `--restart unless-stopped`,
+        `-l ${POOLER_LABEL} -l db=${(0, ssh_1.quote)(config.name)} -l engine=${config.engine}`,
+        `-p ${pooledHostPort}:${internal}`,
+        mounts,
+        image,
+    ]
+        .filter(Boolean)
+        .join(' ');
+    await remote.exec((0, ssh_1.loginShell)(await remote.privileged(poolerCmd)), 120_000);
+    return pooledHostPort;
+}
+/** Tear down the pooler sidecar for a database (container + config files). */
+async function removePooler(remote, name) {
+    await remote.exec((0, ssh_1.loginShell)(`docker rm -f ${(0, ssh_1.quote)(name)}-pooler >/dev/null 2>&1 || true`), 15_000);
+    await remote.exec((0, ssh_1.loginShell)(`rm -f ${(0, ssh_1.quote)(`/tmp/${name}-pgbouncer.ini`)} ${(0, ssh_1.quote)(`/tmp/${name}-userlist.txt`)} ${(0, ssh_1.quote)(`/tmp/${name}-proxysql.cnf`)} >/dev/null 2>&1 || true`), 10_000);
+}
+/** Extract a port number from a `local-address:port` token (IPv4 or IPv6). */
+function parseListeningPort(token) {
+    // IPv6 like [::]:27017 or ::1:27017 — the trailing :<digits> is the port.
+    // IPv4 like 0.0.0.0:27017 or 127.0.0.1:27017.
+    const match = token.match(/:(\d+)$/);
+    return match ? Number(match[1]) : null;
+}
+/**
+ * Get every host TCP port currently in use, from the OS listen table. This
+ * catches ports held by Docker containers AND by any other process (e.g. a
+ * natively installed mongod), and does not depend on `docker ps` output or on
+ * sudo for `-p`. Combines `ss`/`netstat` with a best-effort Docker scan.
+ */
+async function usedPorts(remote) {
+    const ports = new Set();
+    const scan = async (command) => {
+        const { stdout, code } = await remote.exec((0, ssh_1.loginShell)(await remote.privileged(command)), 10_000);
+        return code === 0 ? stdout : null;
+    };
+    // Primary: host listening sockets (no sudo needed for -tln listen table).
+    const socketOut = (await scan('ss -tlnp')) ?? (await scan('ss -tln')) ?? (await scan('netstat -tlnp')) ?? null;
+    if (socketOut) {
+        for (const line of socketOut.split('\n')) {
+            for (const token of line.trim().split(/\s+/)) {
+                const port = parseListeningPort(token);
+                if (port) {
+                    ports.add(port);
+                    break;
+                }
+            }
+        }
+    }
+    // Secondary best-effort: Docker-published host ports. Some setups expose
+    // containers that `ss` may omit (e.g. host-network mode); this backs that up.
+    const dockerOut = await scan("docker ps -a --format '{{.Ports}}'");
+    if (dockerOut) {
+        for (const entry of dockerOut.split(',')) {
+            const match = entry.match(/:(\d+)->/);
+            if (match)
+                ports.add(Number(match[1]));
+        }
+    }
+    return ports;
+}
+/** Find the next available host port starting from `preferred`. */
+async function findPort(remote, preferred) {
+    if (preferred === 0)
+        return 0;
+    const taken = await usedPorts(remote);
+    let port = preferred;
+    while (taken.has(port))
+        port++;
+    return port;
+}
+/**
+ * Ensure Docker is installed and the daemon is running.
+ * Installs docker.io via apt if missing, then starts the service.
+ */
+async function ensureDocker(remote) {
+    // Check if Docker binary exists
+    const { code: binExists } = await remote.exec((0, ssh_1.loginShell)('command -v docker'), 10_000);
+    if (binExists !== 0) {
+        // Install Docker
+        await remote.execOrThrow((0, ssh_1.loginShell)(await remote.privileged('export DEBIAN_FRONTEND=noninteractive; apt-get update && apt-get install -y docker.io')), 180_000);
+    }
+    // Check if Docker daemon is responsive
+    const { code: daemonUp } = await remote.exec((0, ssh_1.loginShell)('docker info >/dev/null 2>&1'), 10_000);
+    if (daemonUp === 0)
+        return;
+    // Try starting Docker with service command (works without systemd)
+    await remote.exec((0, ssh_1.loginShell)(await remote.privileged('service docker start')), 15_000);
+    // Verify it came up
+    const { code: check } = await remote.exec((0, ssh_1.loginShell)('docker info >/dev/null 2>&1'), 10_000);
+    if (check !== 0) {
+        throw new Error('Docker is installed but the daemon could not be started. ' +
+            'Check that Docker is properly installed on this server.');
+    }
+}
+/** List all databases managed by easy-vps. */
+async function list(remote) {
+    const format = '{{.Names}}\\t{{.Labels}}\\t{{.Ports}}\\t{{.State}}';
+    const { stdout, code } = await remote.exec((0, ssh_1.loginShell)(await remote.privileged(`docker ps -a --filter label=easy-vps --format "${format}"`)), 10_000);
+    if (code !== 0)
+        return [];
+    const pooledPorts = new Map();
+    const instances = [];
+    for (const line of stdout.split('\n')) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        const [name, labels, ports, state] = trimmed.split('\t');
+        // Parse labels: easy-vps=database,engine=postgres,user=admin
+        const labelMap = new Map();
+        for (const part of (labels || '').split(',')) {
+            const [k, v] = part.split('=');
+            if (k)
+                labelMap.set(k.trim(), v?.trim() ?? '');
+        }
+        // A pooler sidecar (easy-vps=pooler, db=<name>) only contributes its port.
+        if (labelMap.get('easy-vps') === 'pooler') {
+            const dbName = labelMap.get('db') || '';
+            const portMatch = ports?.match(/:(\d+)->/);
+            if (dbName && portMatch)
+                pooledPorts.set(dbName, Number(portMatch[1]));
+            continue;
+        }
+        if (labelMap.get('easy-vps') !== 'database')
+            continue;
+        const engine = (labelMap.get('engine') || 'postgres');
+        const user = labelMap.get('user') || '';
+        const password = labelMap.get('password') || '';
+        const poolSize = Number(labelMap.get('pool_size')) || 10;
+        // Extract host port from "0.0.0.0:5432->5432/tcp" format
+        let port = 0;
+        const portMatch = ports?.match(/:(\d+)->/);
+        if (portMatch)
+            port = Number(portMatch[1]);
+        let status = 'unknown';
+        if (state === 'running')
+            status = 'running';
+        else if (state === 'exited' || state === 'stopped')
+            status = 'stopped';
+        instances.push({
+            name,
+            engine,
+            user,
+            password,
+            port,
+            host: remote.creds.host,
+            status,
+            pooledPort: 0,
+            poolSize,
+        });
+    }
+    for (const instance of instances) {
+        instance.pooledPort = pooledPorts.get(instance.name) ?? 0;
+    }
+    return instances;
+}
+/** Create a new database container. */
+async function createDatabase(remote, config) {
+    await ensureDocker(remote);
+    const image = ENGINE_IMAGE[config.engine];
+    if (!image)
+        throw new Error(`Unsupported engine: ${config.engine}`);
+    // Stop and remove any existing container with the same name
+    await remote.exec((0, ssh_1.loginShell)(`docker rm -f ${(0, ssh_1.quote)(config.name)} >/dev/null 2>&1 || true`), 10_000);
+    const envArgs = ENGINE_ENV[config.engine](config).join(' ');
+    const internalPort = INTERNAL_PORT[config.engine];
+    const hostPort = await findPort(remote, config.port);
+    const portArg = hostPort ? `-p ${hostPort}:${internalPort}` : '';
+    const labels = `-l ${LABEL} -l engine=${config.engine} -l user=${(0, ssh_1.quote)(config.user)} -l password=${(0, ssh_1.quote)(config.password)} -l pool_size=${config.poolSize}`;
+    const command = [
+        'docker run -d',
+        `--name ${(0, ssh_1.quote)(config.name)}`,
+        '--restart unless-stopped',
+        labels,
+        envArgs,
+        portArg,
+        image,
+    ]
+        .filter(Boolean)
+        .join(' ');
+    const result = await remote.exec((0, ssh_1.loginShell)(await remote.privileged(command)), 120_000);
+    if (result.code !== 0) {
+        const detail = result.stderr.trim() || 'Container start failed';
+        throw new Error(detail);
+    }
+    const pooledPort = await startPooler(remote, config);
+    return { port: hostPort, host: remote.creds.host, pooledPort };
+}
+/** Remove a database container. */
+async function removeDatabase(remote, name) {
+    await ensureDocker(remote);
+    // Stop first, then remove — rm -f handles both but stop first is cleaner
+    await remote.exec((0, ssh_1.loginShell)(await remote.privileged(`docker stop ${(0, ssh_1.quote)(name)} 2>/dev/null || true`)), 15_000);
+    await remote.exec((0, ssh_1.loginShell)(await remote.privileged(`docker rm ${(0, ssh_1.quote)(name)} 2>/dev/null || true`)), 10_000);
+    await removePooler(remote, name);
+    // Verify removal
+    const check = await remote.exec((0, ssh_1.loginShell)(`docker inspect ${(0, ssh_1.quote)(name)} 2>/dev/null`), 10_000);
+    if (check.code === 0) {
+        throw new Error(`Container ${name} could not be removed`);
+    }
+}
+/** Backup a database using pg_dump. */
+async function backup(remote, name) {
+    const dumpPath = `/tmp/${name}-$(date +%Y%m%d-%H%M%S).sql.gz`;
+    const command = `docker exec ${(0, ssh_1.quote)(name)} pg_dumpall -U postgres | gzip > ${(0, ssh_1.quote)(dumpPath)}`;
+    const result = await remote.exec((0, ssh_1.loginShell)(await remote.privileged(command)), 60_000);
+    if (result.code !== 0) {
+        throw new Error(result.stderr.trim() || 'Backup failed');
+    }
+    return { path: dumpPath };
+}
+/** Restore a database from a dump file. */
+async function restore(remote, name, dumpPath) {
+    const command = `gunzip -c ${(0, ssh_1.quote)(dumpPath)} | docker exec -i ${(0, ssh_1.quote)(name)} psql -U postgres`;
+    const result = await remote.exec((0, ssh_1.loginShell)(await remote.privileged(command)), 120_000);
+    if (result.code !== 0) {
+        throw new Error(result.stderr.trim() || 'Restore failed');
+    }
+}
+/** Download a file from the VPS to the panel server using base64 encoding. */
+async function downloadDump(remote, remotePath, localPath) {
+    const { stdout, code } = await remote.exec((0, ssh_1.loginShell)(`base64 < ${(0, ssh_1.quote)(remotePath)}`), 120_000);
+    if (code !== 0) {
+        throw new Error('Failed to download dump from VPS');
+    }
+    const buffer = Buffer.from(stdout.replace(/\n/g, ''), 'base64');
+    (0, node_fs_1.writeFileSync)(localPath, buffer);
+}
+/** Upload a database backup to S3. */
+async function backupToS3(remote, name, engine) {
+    const config = (0, backup_config_1.getBackupConfig)(name);
+    if (!config.s3)
+        throw new Error('S3 not configured for this database');
+    // Create dump on VPS
+    const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+    const remoteDumpPath = `/tmp/${name}-${timestamp}.sql.gz`;
+    const command = `docker exec ${(0, ssh_1.quote)(name)} pg_dumpall -U postgres | gzip > ${(0, ssh_1.quote)(remoteDumpPath)}`;
+    const result = await remote.exec((0, ssh_1.loginShell)(await remote.privileged(command)), 60_000);
+    if (result.code !== 0) {
+        throw new Error(result.stderr.trim() || 'Backup failed');
+    }
+    // Download to panel server temp file
+    const localDumpPath = node_path_1.default.join((0, node_os_1.tmpdir)(), `${name}-${timestamp}.sql.gz`);
+    await downloadDump(remote, remoteDumpPath, localDumpPath);
+    // Upload to S3
+    const s3Key = (0, s3_1.backupS3Key)(engine, name, timestamp);
+    await (0, s3_1.uploadToS3)(config.s3, localDumpPath, s3Key);
+    // Cleanup
+    try {
+        (0, node_fs_1.unlinkSync)(localDumpPath);
+    }
+    catch { /* ignore */ }
+    await remote.exec((0, ssh_1.loginShell)(`rm -f ${(0, ssh_1.quote)(remoteDumpPath)}`), 5_000);
+    return { key: s3Key };
+}
+/** Stream a backup with progress logging via SSH execStream. */
+function backupStream(remote, name, engine, handlers) {
+    let cancelled = false;
+    const run = async () => {
+        try {
+            // Step 1: Create dump on VPS (streamed)
+            const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+            const remoteDumpPath = `/tmp/${name}-${timestamp}.sql.gz`;
+            handlers.onOutput(`Starting backup of ${name} (${engine})…`);
+            const dumpCommand = await remote.privileged(`docker exec ${(0, ssh_1.quote)(name)} pg_dumpall -U postgres | gzip > ${(0, ssh_1.quote)(remoteDumpPath)}`);
+            await new Promise((resolve, reject) => {
+                const cancel = remote.execStream(dumpCommand, {
+                    onOutput: (line) => handlers.onOutput(line),
+                    onDone: () => resolve(),
+                    onError: (msg) => reject(new Error(msg)),
+                });
+                // Store cancel for cleanup
+                if (cancelled)
+                    cancel();
+            });
+            if (cancelled)
+                return;
+            handlers.onOutput('Dump created successfully');
+            // Step 2: Download to panel server
+            handlers.onOutput('Downloading dump from VPS…');
+            const localDumpPath = node_path_1.default.join((0, node_os_1.tmpdir)(), `${name}-${timestamp}.sql.gz`);
+            await downloadDump(remote, remoteDumpPath, localDumpPath);
+            if (cancelled)
+                return;
+            const stats = (0, node_fs_1.readFileSync)(localDumpPath);
+            handlers.onOutput(`Downloaded ${(stats.length / 1024 / 1024).toFixed(1)} MB`);
+            // Step 3: Upload to S3
+            const config = (0, backup_config_1.getBackupConfig)(name);
+            if (config.s3) {
+                handlers.onOutput('Uploading to S3…');
+                const s3Key = (0, s3_1.backupS3Key)(engine, name, timestamp);
+                await (0, s3_1.uploadToS3)(config.s3, localDumpPath, s3Key);
+                handlers.onOutput(`Uploaded to s3://${config.s3.bucket}/${s3Key}`);
+                // Enforce retention
+                handlers.onOutput('Enforcing retention policy…');
+                await (0, s3_1.enforceRetention)(config.s3, engine, name, config.retention);
+                handlers.onOutput('Retention enforced');
+            }
+            // Step 4: Cleanup
+            try {
+                (0, node_fs_1.unlinkSync)(localDumpPath);
+            }
+            catch { /* ignore */ }
+            await remote.exec((0, ssh_1.loginShell)(`rm -f ${(0, ssh_1.quote)(remoteDumpPath)}`), 5_000);
+            if (!cancelled) {
+                handlers.onOutput('Backup complete');
+                handlers.onDone();
+            }
+        }
+        catch (err) {
+            if (!cancelled) {
+                handlers.onError(err.message);
+            }
+        }
+    };
+    run();
+    return () => {
+        cancelled = true;
+    };
+}
+/** Read a backup file from S3 and return its buffer. */
+async function readBackupFromS3(name, engine, s3Key) {
+    const config = (0, backup_config_1.getBackupConfig)(name);
+    if (!config.s3)
+        throw new Error('S3 not configured');
+    const localPath = node_path_1.default.join((0, node_os_1.tmpdir)(), `download-${Date.now()}.dmp`);
+    await (0, s3_1.downloadFromS3)(config.s3, s3Key, localPath);
+    const buffer = (0, node_fs_1.readFileSync)(localPath);
+    try {
+        (0, node_fs_1.unlinkSync)(localPath);
+    }
+    catch { /* ignore */ }
+    const parts = s3Key.split('/');
+    const fileName = `${name}-${parts[parts.length - 2]}.dmp`;
+    return { buffer, fileName };
+}
+/** List backups for a database from S3. */
+async function listBackupsFromS3(name, engine) {
+    const config = (0, backup_config_1.getBackupConfig)(name);
+    if (!config.s3)
+        return [];
+    return (0, s3_1.listS3Backups)(config.s3, engine, name);
+}
+/** Restore a database from an S3 backup. */
+async function restoreFromS3(remote, name, engine, s3Key) {
+    const config = (0, backup_config_1.getBackupConfig)(name);
+    if (!config.s3)
+        throw new Error('S3 not configured for this database');
+    // Download from S3 to panel server
+    const localDumpPath = node_path_1.default.join((0, node_os_1.tmpdir)(), `${name}-restore-${Date.now()}.sql.gz`);
+    await (0, s3_1.downloadFromS3)(config.s3, s3Key, localDumpPath);
+    // Upload to VPS
+    const remoteDumpPath = `/tmp/${name}-restore.sql.gz`;
+    const { readFileSync } = await Promise.resolve().then(() => __importStar(require('node:fs')));
+    const dumpData = readFileSync(localDumpPath);
+    const base64Data = dumpData.toString('base64');
+    // Write to VPS via base64 decode
+    const writeResult = await remote.exec((0, ssh_1.loginShell)(`echo ${(0, ssh_1.quote)(base64Data)} | base64 -d > ${(0, ssh_1.quote)(remoteDumpPath)}`), 30_000);
+    if (writeResult.code !== 0) {
+        throw new Error('Failed to upload dump to VPS');
+    }
+    // Restore
+    const command = `gunzip -c ${(0, ssh_1.quote)(remoteDumpPath)} | docker exec -i ${(0, ssh_1.quote)(name)} psql -U postgres`;
+    const restoreResult = await remote.exec((0, ssh_1.loginShell)(await remote.privileged(command)), 120_000);
+    if (restoreResult.code !== 0) {
+        throw new Error(restoreResult.stderr.trim() || 'Restore failed');
+    }
+    // Cleanup
+    try {
+        (0, node_fs_1.unlinkSync)(localDumpPath);
+    }
+    catch { /* ignore */ }
+    await remote.exec((0, ssh_1.loginShell)(`rm -f ${(0, ssh_1.quote)(remoteDumpPath)}`), 5_000);
+}

package/dist/services/deploy.d.ts

@@ -0,0 +1,102 @@
+import { type Remote, type StreamHandlers } from './ssh';
+export type Runtime = 'pm2' | 'docker';
+export interface DeploymentConfig {
+    name: string;
+    repository: string;
+    branch?: string;
+    /** Domain the site is served on; recorded in the log, proxied by Nginx already. */
+    domain?: string;
+    installCommand: string;
+    buildCommand: string;
+    runCommand: string;
+    runtime: Runtime;
+    port: number;
+}
+/** A deployed site as list() can see it — the commands that created it are not
+ *  recoverable from the server, so this is not a DeploymentConfig. */
+export interface Deployment {
+    name: string;
+    repository: string;
+    branch?: string;
+    domain?: string;
+    runtime: Runtime;
+    port: number;
+    status: 'running' | 'stopped' | 'unknown';
+}
+/** What a queued job will run once its stream opens. */
+export type JobKind = 
+/** Fetch latest, reinstall, build, and recreate the process — a full deploy. */
+'deploy'
+/** Build against the existing clone and restart in place — no pull, no install. */
+ | 'rebuild';
+/** One past run of a site's deploy script, for the Deployments tab's history list. */
+export interface DeploymentRecord {
+    id: string;
+    kind: JobKind;
+    branch: string;
+    /** Short commit hash, once the clone step reports it — rebuilds don't fetch,
+     *  so this stays whatever it already was for that site. */
+    commit?: string;
+    startedAt: number;
+    finishedAt?: number;
+    status: 'running' | 'success' | 'failed';
+    error?: string;
+}
+export declare function deploymentHistory(name: string): DeploymentRecord[];
+/** Validates the form's payload and queues it; the id is what the UI streams. */
+export declare function createJob(sessionId: string, config: DeploymentConfig, kind?: JobKind): string;
+export declare function takeJob(id: string, sessionId: string): {
+    config: DeploymentConfig;
+    kind: JobKind;
+} | null;
+/**
+ * Re-queues the config behind `name`'s last deploy — full pull, or build+restart
+ * only, depending on `kind`. Returns null when no config is known at all: the
+ * site was never deployed through here, or its only deploy never succeeded.
+ */
+export declare function requeueJob(remote: Remote, sessionId: string, name: string, kind: JobKind): Promise<string | null>;
+/**
+ * The whole deploy as one script. `set -e` stops at the first failing step, so a
+ * broken build never reaches the run stage and the exit code reaches the UI.
+ */
+export declare function buildScript(config: DeploymentConfig): string;
+/**
+ * Rebuilds and restarts a site without touching its clone — no fetch, no
+ * `npm install`. For when only the running process needs to pick up a change
+ * (a rebuild of already-pulled code, or a restart after an env upload) and a
+ * full pull isn't wanted.
+ */
+export declare function rebuildScript(config: DeploymentConfig): string;
+/** Runs a queued full deploy: fetch, install, build, recreate the process. */
+export declare function deployStream(remote: Remote, config: DeploymentConfig, handlers: StreamHandlers): () => void;
+/** Runs a queued rebuild: build against the existing clone, restart in place. */
+export declare function rebuildStream(remote: Remote, config: DeploymentConfig, handlers: StreamHandlers): () => void;
+/**
+ * Websites this panel deployed: the clones on disk, joined with whatever PM2 or
+ * Docker currently reports about them, and the domain pointing at their port.
+ */
+export declare function list(remote: Remote): Promise<Deployment[]>;
+export declare function stop(_name: string): Promise<never>;
+/**
+ * Live tail of a deployed site's own output — pm2's log for that process, or
+ * the container's stdout/stderr — starting from recent history and following
+ * as new lines arrive. Runtime is looked up fresh rather than trusted from the
+ * caller, since it's what's actually running that matters here.
+ */
+export declare function logStream(remote: Remote, name: string, handlers: StreamHandlers): () => void;
+/**
+ * Tears down a deployed site: stops it under whichever runtime is running it —
+ * a name only ever exists in one of pm2 or docker, but both are tried since
+ * that runtime isn't known here — then deletes its clone from disk.
+ */
+export declare function remove(remote: Remote, name: string): Promise<void>;
+/** Raw .env contents at the project's root, or null when none has been uploaded. */
+export declare function readEnv(remote: Remote, name: string): Promise<string | null>;
+/**
+ * Replaces the project's .env with the uploaded contents and restarts the site
+ * so it picks up the new values. Docker containers only see this if their
+ * Dockerfile reads .env from the project directory at container start — a
+ * container built to bake env vars in at image build time will need a
+ * re-deploy instead, not just a restart.
+ */
+export declare function writeEnv(remote: Remote, name: string, content: string): Promise<void>;