easy-vps 0.1.0

package/dist/services/deploy.js

@@ -0,0 +1,540 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deploymentHistory = deploymentHistory;
+exports.createJob = createJob;
+exports.takeJob = takeJob;
+exports.requeueJob = requeueJob;
+exports.buildScript = buildScript;
+exports.rebuildScript = rebuildScript;
+exports.deployStream = deployStream;
+exports.rebuildStream = rebuildStream;
+exports.list = list;
+exports.stop = stop;
+exports.logStream = logStream;
+exports.remove = remove;
+exports.readEnv = readEnv;
+exports.writeEnv = writeEnv;
+// Git clone, PM2 runner, Docker runner.
+//
+// A deploy is one long bash script streamed to the browser line by line, so the
+// user watches the same output they would see running these commands by hand.
+// The script is assembled here from what the create form collected: everything
+// after the clone is the user's own install/build/run commands.
+const node_crypto_1 = require("node:crypto");
+const domains = __importStar(require("./domain"));
+const ssh_1 = require("./ssh");
+/** Where clones live on the VPS, under the login user's home. */
+const APPS_DIR = '"$HOME/easy-vps-apps"';
+/** Names are validated on the way in; this is the guard for any other caller. */
+const SAFE_NAME = /^[a-z0-9][a-z0-9._-]*$/i;
+// remote.writeFile()/readFile() single-quote their path argument, so a literal
+// "$HOME" passed through them would never expand. Resolving it once up front
+// keeps the rest of the code able to build ordinary absolute paths.
+const homeDirs = new WeakMap();
+async function homeDir(remote) {
+    let cached = homeDirs.get(remote);
+    if (!cached) {
+        cached = remote.execOrThrow('echo $HOME', 10_000).then((out) => out.trim());
+        homeDirs.set(remote, cached);
+    }
+    return cached;
+}
+async function appDir(remote, name) {
+    return `${await homeDir(remote)}/easy-vps-apps/${name}`;
+}
+/** Filename the deploy config is mirrored to inside the project's own clone,
+ *  so Redeploy survives a panel restart instead of only living in `lastConfig`. */
+const CONFIG_FILENAME = '.easy-vps.json';
+async function writeConfigFile(remote, config) {
+    try {
+        const dir = await appDir(remote, config.name);
+        await remote.writeFile(`${dir}/${CONFIG_FILENAME}`, JSON.stringify(config));
+    }
+    catch {
+        // Best-effort: if this fails, Redeploy just won't survive a panel restart
+        // until the next successful run.
+    }
+}
+async function readConfigFile(remote, name) {
+    try {
+        const dir = await appDir(remote, name);
+        const path = `${dir}/${CONFIG_FILENAME}`;
+        if (!(await remote.exists(path)))
+            return null;
+        return JSON.parse(await remote.readFile(path));
+    }
+    catch {
+        return null;
+    }
+}
+const jobs = new Map();
+const JOB_TTL_MS = 5 * 60 * 1000;
+const HISTORY_LIMIT = 20;
+/** Deploy history, newest first, keyed by site name. In memory only — it does
+ *  not survive a panel restart, same as the sessions and job queue above. */
+const history = new Map();
+function pushHistory(name, record) {
+    const list = history.get(name) ?? [];
+    list.unshift(record);
+    list.length = Math.min(list.length, HISTORY_LIMIT);
+    history.set(name, list);
+}
+function deploymentHistory(name) {
+    return history.get(name) ?? [];
+}
+/** The config behind a site's most recent deploy, so Redeploy can resubmit it
+ *  without asking the user to fill the form out again. */
+const lastConfig = new Map();
+function sweepJobs() {
+    const cutoff = Date.now() - JOB_TTL_MS;
+    for (const [id, job] of jobs) {
+        if (job.createdAt < cutoff)
+            jobs.delete(id);
+    }
+}
+/** Validates the form's payload and queues it; the id is what the UI streams. */
+function createJob(sessionId, config, kind = 'deploy') {
+    sweepJobs();
+    if (!/^[a-z0-9][a-z0-9._-]*$/i.test(config.name ?? '')) {
+        throw new Error('Invalid project name');
+    }
+    if (!/^https:\/\/github\.com\/.+\/.+/.test(config.repository ?? '')) {
+        throw new Error('Repository must be a GitHub URL');
+    }
+    if (config.branch && /[~^:?*[\\\s]/.test(config.branch)) {
+        throw new Error('Invalid branch name');
+    }
+    if (!Number.isInteger(config.port) || config.port < 1 || config.port > 65535) {
+        throw new Error('Invalid port');
+    }
+    if (config.runtime !== 'pm2' && config.runtime !== 'docker') {
+        throw new Error('Runtime must be pm2 or docker');
+    }
+    for (const command of [config.installCommand, config.buildCommand, config.runCommand]) {
+        if (!command?.trim())
+            throw new Error('Install, build and run commands are all required');
+    }
+    lastConfig.set(config.name, config);
+    const id = (0, node_crypto_1.randomBytes)(16).toString('hex');
+    jobs.set(id, { config, kind, sessionId, createdAt: Date.now() });
+    return id;
+}
+function takeJob(id, sessionId) {
+    const job = jobs.get(id);
+    if (!job || job.sessionId !== sessionId)
+        return null;
+    jobs.delete(id);
+    return { config: job.config, kind: job.kind };
+}
+/** The config behind a site's last deploy — checked in memory first, then in
+ *  the file next to its clone, so a panel restart doesn't lose it. */
+async function resolveConfig(remote, name) {
+    const cached = lastConfig.get(name);
+    if (cached)
+        return cached;
+    const config = await readConfigFile(remote, name);
+    if (config)
+        lastConfig.set(name, config);
+    return config;
+}
+/**
+ * Re-queues the config behind `name`'s last deploy — full pull, or build+restart
+ * only, depending on `kind`. Returns null when no config is known at all: the
+ * site was never deployed through here, or its only deploy never succeeded.
+ */
+async function requeueJob(remote, sessionId, name, kind) {
+    const config = await resolveConfig(remote, name);
+    return config ? createJob(sessionId, config, kind) : null;
+}
+/** `echo` of a step banner, so the log reads as phases rather than a wall of output. */
+function step(label) {
+    return `echo ""; echo "==> ${label}"`;
+}
+/**
+ * Starts the app under PM2. Arbitrary run commands ("npm start", "node dist/x")
+ * are handed to bash rather than exec'd directly — pm2 can only start a file.
+ */
+function pm2Start(config) {
+    const name = (0, ssh_1.quote)(config.name);
+    return [
+        step('Starting with PM2'),
+        `pm2 delete ${name} >/dev/null 2>&1 || true`,
+        `PORT=${config.port} pm2 start bash --name ${name} -- -lc ${(0, ssh_1.quote)(config.runCommand)}`,
+        'pm2 save',
+        `pm2 describe ${name}`,
+    ].join('\n');
+}
+/** Builds and runs the repo's Dockerfile, replacing any container of the same name. */
+function dockerStart(config) {
+    const name = (0, ssh_1.quote)(config.name);
+    const tag = (0, ssh_1.quote)(`easy-vps/${config.name}`);
+    return [
+        step('Building the Docker image'),
+        `docker build -t ${tag} .`,
+        step('Starting the container'),
+        `docker rm -f ${name} >/dev/null 2>&1 || true`,
+        `docker run -d --name ${name} --restart unless-stopped ` +
+            `-p ${config.port}:${config.port} -e PORT=${config.port} ${tag}`,
+        `docker ps --filter name=${name}`,
+    ].join('\n');
+}
+/** Restarts the app under PM2 in place — no delete, just a fresh process. */
+function pm2Restart(config) {
+    const name = (0, ssh_1.quote)(config.name);
+    return [step('Restarting with PM2'), `pm2 restart ${name} --update-env`, `pm2 describe ${name}`].join('\n');
+}
+/** Restarts the existing container in place — no rebuild, no re-create. */
+function dockerRestart(config) {
+    const name = (0, ssh_1.quote)(config.name);
+    return [step('Restarting the container'), `docker restart ${name}`, `docker ps --filter name=${name}`].join('\n');
+}
+/**
+ * The whole deploy as one script. `set -e` stops at the first failing step, so a
+ * broken build never reaches the run stage and the exit code reaches the UI.
+ */
+function buildScript(config) {
+    if (!SAFE_NAME.test(config.name))
+        throw new Error('Invalid project name');
+    const branch = config.branch?.trim() || 'main';
+    // Double quotes, not quote(): the shell has to expand $HOME itself.
+    const dir = `"$HOME/easy-vps-apps/${config.name}"`;
+    return [
+        'set -e',
+        `echo "==> Deploying ${config.name} (${config.domain ?? `port ${config.port}`})"`,
+        `mkdir -p ${APPS_DIR}`,
+        step(`Fetching ${config.repository} @ ${branch}`),
+        // Re-deploying an existing site updates the clone in place instead of failing.
+        `if [ -d "$HOME/easy-vps-apps/${config.name}/.git" ]; then
+  cd ${dir}
+  git remote set-url origin ${(0, ssh_1.quote)(config.repository)}
+  git fetch --depth 1 origin ${(0, ssh_1.quote)(branch)}
+  git checkout -B ${(0, ssh_1.quote)(branch)} FETCH_HEAD
+else
+  git clone --depth 1 --branch ${(0, ssh_1.quote)(branch)} ${(0, ssh_1.quote)(config.repository)} ${dir}
+  cd ${dir}
+fi`,
+        'git --no-pager log -1 --pretty="cloned %h %s"',
+        step('Installing dependencies'),
+        config.installCommand,
+        step('Building'),
+        config.buildCommand,
+        config.runtime === 'pm2' ? pm2Start(config) : dockerStart(config),
+        `echo ""; echo "==> ${config.name} is live on port ${config.port}"`,
+    ].join('\n');
+}
+/**
+ * Rebuilds and restarts a site without touching its clone — no fetch, no
+ * `npm install`. For when only the running process needs to pick up a change
+ * (a rebuild of already-pulled code, or a restart after an env upload) and a
+ * full pull isn't wanted.
+ */
+function rebuildScript(config) {
+    if (!SAFE_NAME.test(config.name))
+        throw new Error('Invalid project name');
+    const dir = `"$HOME/easy-vps-apps/${config.name}"`;
+    return [
+        'set -e',
+        `echo "==> Rebuilding ${config.name} (${config.domain ?? `port ${config.port}`})"`,
+        `if [ ! -d "$HOME/easy-vps-apps/${config.name}/.git" ]; then
+  echo "No existing clone for ${config.name} — use Pull & Redeploy instead." >&2
+  exit 1
+fi`,
+        `cd ${dir}`,
+        step('Building'),
+        config.buildCommand,
+        config.runtime === 'pm2' ? pm2Restart(config) : dockerRestart(config),
+        `echo ""; echo "==> ${config.name} is live on port ${config.port}"`,
+    ].join('\n');
+}
+/** The most recent commit hash recorded for a site, if any run has reported one. */
+function lastKnownCommit(name) {
+    return history.get(name)?.find((record) => record.commit)?.commit;
+}
+/**
+ * Runs a queued script — full deploy or build-only rebuild — streaming every
+ * line and recording it to history. Returns a cancel function.
+ */
+function runTrackedStream(remote, config, kind, script, handlers) {
+    handlers.onOutput(`$ ssh ${remote.username}@${remote.host}`);
+    const record = {
+        id: (0, node_crypto_1.randomBytes)(8).toString('hex'),
+        kind,
+        branch: config.branch?.trim() || 'main',
+        // A rebuild doesn't re-fetch, so it's still running whatever was last pulled.
+        commit: kind === 'rebuild' ? lastKnownCommit(config.name) : undefined,
+        startedAt: Date.now(),
+        status: 'running',
+    };
+    pushHistory(config.name, record);
+    const tracked = {
+        onOutput: (line) => {
+            // buildScript's own `git log` step prints this once the clone lands.
+            const commit = /^cloned ([0-9a-f]{4,40})/.exec(line);
+            if (commit)
+                record.commit = commit[1];
+            handlers.onOutput(line);
+        },
+        onDone: () => {
+            record.status = 'success';
+            record.finishedAt = Date.now();
+            // Fire-and-forget: the clone now exists, so this is the point where the
+            // config can actually be written next to it.
+            void writeConfigFile(remote, config);
+            handlers.onDone();
+        },
+        onError: (message) => {
+            record.status = 'failed';
+            record.finishedAt = Date.now();
+            record.error = message;
+            handlers.onError(message);
+        },
+    };
+    // No timeout: installs and builds routinely outlast any exec() deadline.
+    return remote.execStream((0, ssh_1.loginShell)(script), tracked);
+}
+/** Runs a queued full deploy: fetch, install, build, recreate the process. */
+function deployStream(remote, config, handlers) {
+    return runTrackedStream(remote, config, 'deploy', buildScript(config), handlers);
+}
+/** Runs a queued rebuild: build against the existing clone, restart in place. */
+function rebuildStream(remote, config, handlers) {
+    return runTrackedStream(remote, config, 'rebuild', rebuildScript(config), handlers);
+}
+/**
+ * Every directory under the apps dir, with the repo it was cloned from. Printed
+ * as one tab-separated line per app so a single exec covers the whole list.
+ */
+async function clones(remote) {
+    const script = [
+        'shopt -s nullglob',
+        'for dir in "$HOME/easy-vps-apps"/*/; do',
+        '  name=$(basename "$dir")',
+        '  repo=$(git -C "$dir" config --get remote.origin.url 2>/dev/null)',
+        '  branch=$(git -C "$dir" rev-parse --abbrev-ref HEAD 2>/dev/null)',
+        '  printf "%s\\t%s\\t%s\\n" "$name" "$repo" "$branch"',
+        'done',
+    ].join('\n');
+    const { stdout, code } = await remote.exec((0, ssh_1.loginShell)(script), 15_000);
+    if (code !== 0)
+        return [];
+    return stdout
+        .split('\n')
+        .map((line) => line.split('\t'))
+        .filter((parts) => parts[0]?.trim())
+        .map(([name, repository, branch]) => ({
+        name: name.trim(),
+        repository: repository?.trim() ?? '',
+        branch: branch?.trim() || 'main',
+    }));
+}
+/** PM2 processes by name, with the port they were started on. */
+async function pm2Processes(remote) {
+    const found = new Map();
+    const { stdout, code } = await remote.exec((0, ssh_1.loginShell)('pm2 jlist'), 15_000);
+    if (code !== 0)
+        return found;
+    // pm2 prints update notices around the JSON; take the array itself.
+    const start = stdout.indexOf('[');
+    const end = stdout.lastIndexOf(']');
+    if (start === -1 || end <= start)
+        return found;
+    try {
+        const parsed = JSON.parse(stdout.slice(start, end + 1));
+        for (const process of parsed) {
+            if (!process.name)
+                continue;
+            const rawPort = process.pm2_env?.PORT ?? process.pm2_env?.env?.PORT;
+            const port = Number(rawPort);
+            found.set(process.name, {
+                status: process.pm2_env?.status ?? 'unknown',
+                port: Number.isInteger(port) && port > 0 ? port : undefined,
+            });
+        }
+    }
+    catch {
+        return found;
+    }
+    return found;
+}
+/** Docker containers by name, with the host port they publish. */
+async function dockerContainers(remote) {
+    const found = new Map();
+    const command = 'docker ps -a --format "{{.Names}}\\t{{.State}}\\t{{.Ports}}"';
+    const { stdout, code } = await remote.exec((0, ssh_1.loginShell)(await remote.privileged(command)), 15_000);
+    if (code !== 0)
+        return found;
+    for (const line of stdout.split('\n')) {
+        const [name, state, ports] = line.split('\t');
+        if (!name?.trim())
+            continue;
+        // "0.0.0.0:4000->4000/tcp" — the published host port is the one before "->".
+        const published = /:(\d+)->/.exec(ports ?? '');
+        found.set(name.trim(), {
+            running: state?.trim() === 'running',
+            port: published ? Number(published[1]) : undefined,
+        });
+    }
+    return found;
+}
+/**
+ * Websites this panel deployed: the clones on disk, joined with whatever PM2 or
+ * Docker currently reports about them, and the domain pointing at their port.
+ */
+async function list(remote) {
+    const [cloned, pm2, docker, configured] = await Promise.all([
+        clones(remote),
+        pm2Processes(remote),
+        dockerContainers(remote),
+        domains.list(remote).catch(() => []),
+    ]);
+    const domainForPort = new Map(configured.map((entry) => [entry.port, entry.domain]));
+    return cloned.map(({ name, repository, branch }) => {
+        const process = pm2.get(name);
+        const container = docker.get(name);
+        const runtime = container && !process ? 'docker' : 'pm2';
+        const port = process?.port ?? container?.port ?? 0;
+        let status = 'unknown';
+        if (process)
+            status = process.status === 'online' ? 'running' : 'stopped';
+        else if (container)
+            status = container.running ? 'running' : 'stopped';
+        return {
+            name,
+            repository,
+            branch,
+            domain: domainForPort.get(port),
+            runtime,
+            port,
+            status,
+        };
+    });
+}
+async function stop(_name) {
+    throw new Error('stop() is not implemented yet');
+}
+/**
+ * Live tail of a deployed site's own output — pm2's log for that process, or
+ * the container's stdout/stderr — starting from recent history and following
+ * as new lines arrive. Runtime is looked up fresh rather than trusted from the
+ * caller, since it's what's actually running that matters here.
+ */
+function logStream(remote, name, handlers) {
+    if (!SAFE_NAME.test(name)) {
+        handlers.onError('Invalid project name');
+        return () => undefined;
+    }
+    let cancel = () => undefined;
+    let cancelled = false;
+    void (async () => {
+        const [pm2, docker] = await Promise.all([pm2Processes(remote), dockerContainers(remote)]);
+        if (cancelled)
+            return;
+        if (pm2.has(name)) {
+            const command = `pm2 logs ${(0, ssh_1.quote)(name)} --lines 200 --raw`;
+            handlers.onOutput(`$ ${command}`);
+            cancel = remote.execStream((0, ssh_1.loginShell)(command), handlers);
+        }
+        else if (docker.has(name)) {
+            const command = `docker logs -f --tail 200 ${(0, ssh_1.quote)(name)}`;
+            handlers.onOutput(`$ ${command}`);
+            cancel = remote.execStream((0, ssh_1.loginShell)(command), handlers);
+        }
+        else {
+            handlers.onError(`"${name}" is not currently running under pm2 or Docker.`);
+        }
+    })().catch((error) => {
+        if (!cancelled)
+            handlers.onError(error.message);
+    });
+    return () => {
+        cancelled = true;
+        cancel();
+    };
+}
+/**
+ * Tears down a deployed site: stops it under whichever runtime is running it —
+ * a name only ever exists in one of pm2 or docker, but both are tried since
+ * that runtime isn't known here — then deletes its clone from disk.
+ */
+async function remove(remote, name) {
+    if (!SAFE_NAME.test(name))
+        throw new Error('Invalid project name');
+    const script = [
+        `pm2 delete ${(0, ssh_1.quote)(name)} >/dev/null 2>&1 || true`,
+        'pm2 save >/dev/null 2>&1 || true',
+        `docker rm -f ${(0, ssh_1.quote)(name)} >/dev/null 2>&1 || true`,
+        `rm -rf "$HOME/easy-vps-apps/${name}"`,
+    ].join('\n');
+    await remote.execOrThrow((0, ssh_1.loginShell)(script), 30_000);
+}
+/** Restarts whichever runtime is currently running `name`, so it re-reads its .env. */
+async function restart(remote, name) {
+    const [pm2, docker] = await Promise.all([pm2Processes(remote), dockerContainers(remote)]);
+    if (pm2.has(name)) {
+        await remote.execOrThrow((0, ssh_1.loginShell)(`pm2 restart ${(0, ssh_1.quote)(name)} --update-env`), 30_000);
+    }
+    else if (docker.has(name)) {
+        await remote.execOrThrow((0, ssh_1.loginShell)(`docker restart ${(0, ssh_1.quote)(name)}`), 30_000);
+    }
+    else {
+        throw new Error(`"${name}" is not currently running under pm2 or Docker.`);
+    }
+}
+/** Raw .env contents at the project's root, or null when none has been uploaded. */
+async function readEnv(remote, name) {
+    if (!SAFE_NAME.test(name))
+        throw new Error('Invalid project name');
+    const path = `${await appDir(remote, name)}/.env`;
+    if (!(await remote.exists(path)))
+        return null;
+    return remote.readFile(path);
+}
+/**
+ * Replaces the project's .env with the uploaded contents and restarts the site
+ * so it picks up the new values. Docker containers only see this if their
+ * Dockerfile reads .env from the project directory at container start — a
+ * container built to bake env vars in at image build time will need a
+ * re-deploy instead, not just a restart.
+ */
+async function writeEnv(remote, name, content) {
+    if (!SAFE_NAME.test(name))
+        throw new Error('Invalid project name');
+    const dir = await appDir(remote, name);
+    if (!(await remote.exists(dir)))
+        throw new Error(`"${name}" has not been deployed`);
+    await remote.writeFile(`${dir}/.env`, content);
+    await restart(remote, name);
+}

package/dist/services/domain.d.ts

@@ -0,0 +1,26 @@
+import { type Remote } from './ssh';
+export interface DomainConfig {
+    domain: string;
+    /** Local port the app listens on; Nginx proxies to it. */
+    port: number;
+    ssl?: boolean;
+}
+/** Outcome of addDomain(). The domain is always in place; only SSL can partially fail. */
+export interface AddDomainResult {
+    domain: string;
+    /** "skipped" when SSL was not requested. */
+    ssl: 'issued' | 'skipped' | 'failed';
+    /** Why SSL failed, when it did. */
+    sslError?: string;
+}
+export interface DomainState {
+    domain: string;
+    port: number;
+    ssl: boolean;
+    active: boolean;
+    certificateActive: boolean;
+}
+export declare function list(remote: Remote): Promise<DomainState[]>;
+export declare function addDomain(remote: Remote, config: DomainConfig): Promise<AddDomainResult>;
+export declare function removeDomain(remote: Remote, domain: string): Promise<void>;
+export declare function issueCertificate(remote: Remote, domain: string): Promise<void>;