easy-vps 0.1.0

package/dist/services/domain.js

@@ -0,0 +1,170 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.list = list;
+exports.addDomain = addDomain;
+exports.removeDomain = removeDomain;
+exports.issueCertificate = issueCertificate;
+// Nginx config writer & Certbot SSL, applied to the managed VPS over SSH.
+const node_path_1 = __importDefault(require("node:path"));
+const system = __importStar(require("./system"));
+const ssh_1 = require("./ssh");
+const SITES_AVAILABLE = '/etc/nginx/sites-available';
+const SITES_ENABLED = '/etc/nginx/sites-enabled';
+const LETSENCRYPT_LIVE = '/etc/letsencrypt/live';
+// Same shape as the client's validateDomain() in client-ui/src/modules/domains/validation.ts —
+// re-checked here because the domain lands verbatim in an Nginx server_name directive.
+const HOSTNAME_RE = /^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}$/i;
+function availablePath(domain) {
+    return node_path_1.default.join(SITES_AVAILABLE, domain);
+}
+function enabledPath(domain) {
+    return node_path_1.default.join(SITES_ENABLED, domain);
+}
+/** Every mutation here writes under /etc, so fail early with a useful message. */
+async function assertPrivileged(remote) {
+    if (await system.canAdminister(remote))
+        return;
+    throw new Error(`"${remote.username}" cannot write Nginx config on ${remote.host}. ` +
+        'Log in as root, or enable passwordless sudo.');
+}
+function assertValidDomain(domain) {
+    if (!HOSTNAME_RE.test(domain)) {
+        throw new Error(`"${domain}" is not a valid domain name`);
+    }
+}
+function renderConfig(config) {
+    return `server {
+    listen 80;
+    server_name ${config.domain} www.${config.domain};
+
+    location / {
+        proxy_pass http://localhost:${config.port};
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection 'upgrade';
+        proxy_set_header Host $host;
+        proxy_cache_bypass $http_upgrade;
+    }
+}
+`;
+}
+/** Parses the port an existing site config proxies to, e.g. "proxy_pass http://localhost:3000;" -> 3000. */
+function parsePort(contents) {
+    const match = /proxy_pass\s+http:\/\/localhost:(\d+);/.exec(contents);
+    return match ? Number(match[1]) : 0;
+}
+async function testConfig(remote) {
+    const command = await remote.privileged('nginx -t');
+    const { stderr, stdout, code } = await remote.exec(command);
+    if (code !== 0) {
+        throw new Error((stderr || stdout).trim() || 'nginx -t failed');
+    }
+}
+async function reloadNginx(remote) {
+    await remote.execOrThrow(await remote.privileged('systemctl reload nginx'));
+}
+async function list(remote) {
+    const domains = await remote.listDir(SITES_AVAILABLE);
+    return Promise.all(domains.map(async (domain) => {
+        const [contents, certificateActive, active] = await Promise.all([
+            remote.readFile(availablePath(domain)).catch(() => ''),
+            remote.exists(node_path_1.default.join(LETSENCRYPT_LIVE, domain)),
+            remote.exists(enabledPath(domain)),
+        ]);
+        return {
+            domain,
+            port: parsePort(contents),
+            ssl: certificateActive,
+            active,
+            certificateActive,
+        };
+    }));
+}
+async function addDomain(remote, config) {
+    assertValidDomain(config.domain);
+    await assertPrivileged(remote);
+    await remote.writeFile(availablePath(config.domain), renderConfig(config));
+    await remote.symlink(availablePath(config.domain), enabledPath(config.domain));
+    try {
+        await testConfig(remote);
+    }
+    catch (error) {
+        await remote.remove(enabledPath(config.domain));
+        await remote.remove(availablePath(config.domain));
+        throw error;
+    }
+    await reloadNginx(remote);
+    if (!config.ssl)
+        return { domain: config.domain, ssl: 'skipped' };
+    // The vhost is already live at this point, so a certificate failure is a partial
+    // success, not a failed request — report it instead of throwing the domain away.
+    try {
+        await issueCertificate(remote, config.domain);
+        return { domain: config.domain, ssl: 'issued' };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return { domain: config.domain, ssl: 'failed', sslError: message };
+    }
+}
+async function removeDomain(remote, domain) {
+    assertValidDomain(domain);
+    await assertPrivileged(remote);
+    await remote.remove(enabledPath(domain));
+    await remote.remove(availablePath(domain));
+    await remote.exec(await remote.privileged(`certbot delete --cert-name ${(0, ssh_1.quote)(domain)} --non-interactive`));
+    await testConfig(remote);
+    await reloadNginx(remote);
+}
+async function issueCertificate(remote, domain) {
+    assertValidDomain(domain);
+    await assertPrivileged(remote);
+    const certbot = await system.detect(remote, 'certbot');
+    if (!certbot.installed) {
+        throw new Error('Certbot is not installed on this server');
+    }
+    const command = [
+        'certbot --nginx',
+        `-d ${(0, ssh_1.quote)(domain)}`,
+        `-d ${(0, ssh_1.quote)(`www.${domain}`)}`,
+        '--non-interactive --agree-tos --redirect --register-unsafely-without-email',
+    ].join(' ');
+    // Certbot talks to Let's Encrypt, so it needs longer than the default budget.
+    await remote.execOrThrow(await remote.privileged(command), 120_000);
+}

package/dist/services/firewall.d.ts

@@ -0,0 +1,24 @@
+import { Remote } from './ssh';
+export interface FirewallRule {
+    /** 1-based position as printed by `ufw status numbered`, used for deletes. */
+    number: number;
+    /** Destination, e.g. "22/tcp" or "Anywhere". */
+    to: string;
+    /** Action with direction, e.g. "ALLOW IN". */
+    action: string;
+    /** Source, e.g. "Anywhere" or "192.168.0.0/16". */
+    from: string;
+}
+export interface FirewallStatus {
+    /** ufw is present on the server. */
+    installed: boolean;
+    /** ufw is running and enforcing rules. */
+    active: boolean;
+    rules: FirewallRule[];
+}
+export declare function getStatus(remote: Remote): Promise<FirewallStatus>;
+export declare function allowPort(remote: Remote, port: number, protocol?: 'tcp' | 'udp'): Promise<void>;
+export declare function deleteRule(remote: Remote, number: number): Promise<void>;
+/** Turns the firewall on, answering ufw's "disrupt SSH?" prompt with yes. */
+export declare function enableFirewall(remote: Remote): Promise<void>;
+export declare function disableFirewall(remote: Remote): Promise<void>;

package/dist/services/firewall.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getStatus = getStatus;
+exports.allowPort = allowPort;
+exports.deleteRule = deleteRule;
+exports.enableFirewall = enableFirewall;
+exports.disableFirewall = disableFirewall;
+// Reads and mutates the managed server's ufw firewall over SSH. All commands
+// run on the remote; the panel process itself never touches a local firewall.
+const ssh_1 = require("./ssh");
+// `[ 1] 22/tcp  ALLOW IN  Anywhere` — action is two words ("ALLOW IN").
+const RULE_RE = /\[\s*(\d+)\]\s+(\S+)\s+(\S+\s+\S+)\s+(.+)/;
+function parseStatus(output) {
+    const active = /Status:\s*active/i.test(output);
+    const rules = [];
+    for (const line of output.split('\n')) {
+        const match = RULE_RE.exec(line);
+        if (match) {
+            rules.push({
+                number: Number(match[1]),
+                to: match[2],
+                action: match[3],
+                from: match[4].trim(),
+            });
+        }
+    }
+    return { active, rules };
+}
+async function getStatus(remote) {
+    const command = await remote.privileged('ufw status numbered');
+    const { code, stdout, stderr } = await remote.exec(command);
+    if (code !== 0) {
+        if (/not installed|command not found|No such file/i.test(`${stderr} ${stdout}`)) {
+            return { installed: false, active: false, rules: [] };
+        }
+        throw new ssh_1.RemoteError(stderr.trim() || 'Failed to read firewall status');
+    }
+    const parsed = parseStatus(stdout);
+    return { installed: true, ...parsed };
+}
+async function allowPort(remote, port, protocol = 'tcp') {
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new ssh_1.RemoteError('Port must be a number between 1 and 65535');
+    }
+    const command = await remote.privileged(`ufw allow ${port}/${protocol}`);
+    await remote.execOrThrow(command);
+}
+async function deleteRule(remote, number) {
+    if (!Number.isInteger(number) || number < 1) {
+        throw new ssh_1.RemoteError('Invalid rule number');
+    }
+    // `--force` avoids the interactive confirmation ufw prints for the last rule.
+    const command = await remote.privileged(`ufw --force delete ${number}`);
+    await remote.execOrThrow(command);
+}
+/** Turns the firewall on, answering ufw's "disrupt SSH?" prompt with yes. */
+async function enableFirewall(remote) {
+    const command = await remote.privileged(`printf 'y\\n' | ufw enable`);
+    await remote.execOrThrow(command);
+}
+async function disableFirewall(remote) {
+    const command = await remote.privileged('ufw disable');
+    await remote.execOrThrow(command);
+}

package/dist/services/instances.d.ts

@@ -0,0 +1,17 @@
+import { type Remote, type StreamHandlers } from './ssh';
+export type InstanceState = 'running' | 'stopped' | 'unknown';
+export interface Pm2Instance {
+    name: string;
+    pid: number | null;
+    status: InstanceState;
+    instanceId: number;
+    cpu: number;
+    memoryMb: number;
+    restarts: number;
+    uptime: string;
+}
+export declare function list(remote: Remote): Promise<Pm2Instance[]>;
+export declare function restart(remote: Remote, name: string): Promise<void>;
+export declare function stop(remote: Remote, name: string): Promise<void>;
+export declare function remove(remote: Remote, name: string): Promise<void>;
+export declare function logStream(remote: Remote, name: string, handlers: StreamHandlers): () => void;

package/dist/services/instances.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.list = list;
+exports.restart = restart;
+exports.stop = stop;
+exports.remove = remove;
+exports.logStream = logStream;
+// PM2 process list — status, cpu, memory and restarts per instance.
+const ssh_1 = require("./ssh");
+function formatUptime(ms) {
+    const seconds = Math.floor(ms / 1000);
+    const minutes = Math.floor(seconds / 60);
+    const hours = Math.floor(minutes / 60);
+    const days = Math.floor(hours / 24);
+    if (days > 0)
+        return `${days}d ${hours % 24}h`;
+    if (hours > 0)
+        return `${hours}h ${minutes % 60}m`;
+    if (minutes > 0)
+        return `${minutes}m ${seconds % 60}s`;
+    return `${seconds}s`;
+}
+async function list(remote) {
+    const { stdout, code } = await remote.exec((0, ssh_1.loginShell)('pm2 jlist'), 15_000);
+    if (code !== 0)
+        return [];
+    const start = stdout.indexOf('[');
+    const end = stdout.lastIndexOf(']');
+    if (start === -1 || end <= start)
+        return [];
+    try {
+        const parsed = JSON.parse(stdout.slice(start, end + 1));
+        return parsed
+            .filter((p) => p.name)
+            .map((p) => {
+            const now = Date.now();
+            const uptimeMs = p.pm2_env?.pm_uptime ? now - p.pm2_env.pm_uptime : 0;
+            return {
+                name: p.name,
+                pid: p.pid ?? null,
+                status: p.pm2_env?.status ?? 'unknown',
+                instanceId: p.pm_id ?? 0,
+                cpu: p.monit?.cpu ?? 0,
+                memoryMb: Math.round((p.monit?.memory ?? 0) / 1024 / 1024),
+                restarts: p.pm2_env?.restart_time ?? 0,
+                uptime: formatUptime(uptimeMs),
+            };
+        });
+    }
+    catch {
+        return [];
+    }
+}
+async function restart(remote, name) {
+    await remote.execOrThrow((0, ssh_1.loginShell)(`pm2 restart ${(0, ssh_1.quote)(name)} --update-env`), 30_000);
+}
+async function stop(remote, name) {
+    await remote.execOrThrow((0, ssh_1.loginShell)(`pm2 stop ${(0, ssh_1.quote)(name)}`), 30_000);
+}
+async function remove(remote, name) {
+    await remote.execOrThrow((0, ssh_1.loginShell)(`pm2 delete ${(0, ssh_1.quote)(name)}`), 30_000);
+}
+function logStream(remote, name, handlers) {
+    const command = `pm2 logs ${(0, ssh_1.quote)(name)} --lines 200 --raw`;
+    handlers.onOutput(`$ ${command}`);
+    return remote.execStream((0, ssh_1.loginShell)(command), handlers);
+}

package/dist/services/logs.d.ts

@@ -0,0 +1,8 @@
+import { type Remote, type StreamHandlers } from './ssh';
+export type LogSourceId = 'panel' | 'nginx' | 'pm2' | 'docker';
+export declare function isValidSource(id: string): id is LogSourceId;
+/**
+ * Starts streaming logs for the given source. Returns a cancel function that
+ * tears down the SSH channel when the client disconnects.
+ */
+export declare function stream(remote: Remote, sourceId: LogSourceId, handlers: StreamHandlers): () => void;

package/dist/services/logs.js

@@ -0,0 +1,61 @@
+"use strict";
+// Streams runtime logs from four sources on the managed VPS: the panel
+// (journalctl), Nginx error log, PM2 aggregate output, and Docker events.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isValidSource = isValidSource;
+exports.stream = stream;
+const ssh_1 = require("./ssh");
+const VALID_SOURCES = new Set([
+    'panel',
+    'nginx',
+    'pm2',
+    'docker',
+]);
+function isValidSource(id) {
+    return VALID_SOURCES.has(id);
+}
+/**
+ * Starts streaming logs for the given source. Returns a cancel function that
+ * tears down the SSH channel when the client disconnects.
+ */
+function stream(remote, sourceId, handlers) {
+    switch (sourceId) {
+        case 'panel':
+            return streamPanel(remote, handlers);
+        case 'nginx':
+            return streamNginx(remote, handlers);
+        case 'pm2':
+            return streamPm2(remote, handlers);
+        case 'docker':
+            return streamDocker(remote, handlers);
+    }
+}
+/** journalctl -f for the easy-vps service unit. */
+function streamPanel(remote, handlers) {
+    const command = 'journalctl -u easy-vps -f --no-pager -o short-iso';
+    handlers.onOutput(`$ ${command}`);
+    return remote.execStream((0, ssh_1.loginShell)(command), handlers);
+}
+/** Follow the Nginx error log. */
+function streamNginx(remote, handlers) {
+    const command = 'tail -f -n 200 /var/log/nginx/error.log';
+    handlers.onOutput(`$ ${command}`);
+    return remote.execStream((0, ssh_1.loginShell)(command), handlers);
+}
+/** Aggregate PM2 log output from all managed processes. */
+function streamPm2(remote, handlers) {
+    const command = 'pm2 logs --raw --nostream --lines 200 && pm2 logs --raw';
+    handlers.onOutput(`$ pm2 logs --raw`);
+    return remote.execStream((0, ssh_1.loginShell)(command), handlers);
+}
+/**
+ * Docker doesn't have a single "follow all containers" command, so we stream
+ * `docker events` which shows container lifecycle activity (start, stop, die,
+ * oom, etc.) in real time. Application-level logs remain per-site in the
+ * website detail page.
+ */
+function streamDocker(remote, handlers) {
+    const command = 'docker events --format "{{json .}}" --since 1h';
+    handlers.onOutput(`$ docker events`);
+    return remote.execStream((0, ssh_1.loginShell)(command), handlers);
+}

package/dist/services/metrics-history.d.ts

@@ -0,0 +1,13 @@
+import type { LoadAverage } from './system';
+/** A single load-average reading captured at a point in time. */
+export interface LoadSample {
+    /** Epoch milliseconds when the sample was captured. */
+    t: number;
+    one: number;
+    five: number;
+    fifteen: number;
+}
+/** Records the latest load reading for a host, one sample per 5-minute bucket. */
+export declare function recordLoad(host: string, load: LoadAverage): void;
+/** Returns the last hour of load samples for a host, oldest first. */
+export declare function getLoadHistory(host: string): LoadSample[];

package/dist/services/metrics-history.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.recordLoad = recordLoad;
+exports.getLoadHistory = getLoadHistory;
+const BUCKET_MS = 5 * 60 * 1000;
+const BUCKETS = 12; // 12 × 5 min = 1 hour
+/**
+ * In-memory, per-host ring of load-average samples bucketed to 5-minute
+ * windows. The panel only collects metrics on demand, so this fills in over
+ * the first hour a session is open; gaps before then are simply absent.
+ */
+const history = new Map();
+/** Records the latest load reading for a host, one sample per 5-minute bucket. */
+function recordLoad(host, load) {
+    const now = Date.now();
+    const bucket = Math.floor(now / BUCKET_MS);
+    let buckets = history.get(host);
+    if (!buckets) {
+        buckets = new Map();
+        history.set(host, buckets);
+    }
+    buckets.set(bucket, { t: now, one: load.one, five: load.five, fifteen: load.fifteen });
+    // Drop anything older than the retained window.
+    const cutoff = bucket - BUCKETS + 1;
+    for (const key of buckets.keys()) {
+        if (key < cutoff)
+            buckets.delete(key);
+    }
+}
+/** Returns the last hour of load samples for a host, oldest first. */
+function getLoadHistory(host) {
+    const buckets = history.get(host);
+    if (!buckets)
+        return [];
+    return [...buckets.values()].sort((a, b) => a.t - b.t);
+}

package/dist/services/packages.d.ts

@@ -0,0 +1,22 @@
+export type DependencyName = 'nginx' | 'pm2' | 'docker' | 'certbot' | 'git' | 'nodejs' | 'redis' | 'ufw' | 'fail2ban' | 'htop';
+export interface PackageDefinition {
+    packageName: DependencyName;
+    /** Prints the version and exits non-zero when the package is absent. */
+    versionCommand: string;
+    installCommand: string;
+    /** Purges the package *and* the paths listed in `removes`. */
+    uninstallCommand: string;
+    /**
+     * Everything the uninstall deletes, beyond the package itself. Sent to the UI
+     * so the confirmation dialog can name what is about to be destroyed rather
+     * than asking the user to take it on faith.
+     */
+    removes: string[];
+}
+/**
+ * Stands in for the absolute path to npm, resolved on the server at run time.
+ * npm is not reliably on a non-interactive PATH — see resolveNpm() in system.ts.
+ */
+export declare const NPM_PLACEHOLDER = "{{npm}}";
+export declare const PACKAGES: Record<DependencyName, PackageDefinition>;
+export declare const DEPENDENCY_NAMES: DependencyName[];

package/dist/services/packages.js

@@ -0,0 +1,124 @@
+"use strict";
+// One definition per managed dependency: how to detect it, install it, and
+// remove it along with the files it leaves behind.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEPENDENCY_NAMES = exports.PACKAGES = exports.NPM_PLACEHOLDER = void 0;
+/**
+ * Stands in for the absolute path to npm, resolved on the server at run time.
+ * npm is not reliably on a non-interactive PATH — see resolveNpm() in system.ts.
+ */
+exports.NPM_PLACEHOLDER = '{{npm}}';
+const apt = (packages, removes) => [
+    `apt-get purge -y ${packages}`,
+    'apt-get autoremove -y',
+    ...removes.map((target) => `rm -rf ${target}`),
+].join(' && ');
+exports.PACKAGES = {
+    nginx: {
+        packageName: 'nginx',
+        versionCommand: 'nginx -v',
+        installCommand: 'apt-get install -y nginx',
+        uninstallCommand: apt('nginx nginx-common nginx-core', [
+            '/etc/nginx',
+            '/var/log/nginx',
+            '/var/www/html',
+        ]),
+        removes: ['/etc/nginx', '/var/log/nginx', '/var/www/html'],
+    },
+    pm2: {
+        packageName: 'pm2',
+        versionCommand: 'pm2 --version',
+        installCommand: `${exports.NPM_PLACEHOLDER} install -g pm2`,
+        // Kill the daemon first, or it lingers holding the old binary's state.
+        uninstallCommand: [
+            `(${exports.NPM_PLACEHOLDER} exec -- pm2 kill || pm2 kill || true)`,
+            `(${exports.NPM_PLACEHOLDER} uninstall -g pm2 || true)`,
+            'rm -rf "$HOME"/.pm2',
+        ].join(' && '),
+        removes: ['~/.pm2 (process list, logs and dumps)'],
+    },
+    docker: {
+        packageName: 'docker',
+        versionCommand: 'docker --version',
+        installCommand: 'apt-get install -y docker.io',
+        uninstallCommand: apt('docker.io docker-compose', [
+            '/var/lib/docker',
+            '/var/lib/containerd',
+            '/etc/docker',
+        ]),
+        removes: [
+            '/var/lib/docker (all images, containers and volumes)',
+            '/var/lib/containerd',
+            '/etc/docker',
+        ],
+    },
+    certbot: {
+        packageName: 'certbot',
+        versionCommand: 'certbot --version',
+        installCommand: 'apt-get install -y certbot python3-certbot-nginx',
+        uninstallCommand: apt('certbot python3-certbot-nginx', [
+            '/etc/letsencrypt',
+            '/var/lib/letsencrypt',
+            '/var/log/letsencrypt',
+        ]),
+        removes: [
+            '/etc/letsencrypt (every certificate and private key)',
+            '/var/lib/letsencrypt',
+            '/var/log/letsencrypt',
+        ],
+    },
+    git: {
+        packageName: 'git',
+        versionCommand: 'git --version',
+        // Leaves ~/.gitconfig and cloned repositories alone: those are user data,
+        // not configuration this panel created.
+        installCommand: 'apt-get install -y git',
+        uninstallCommand: apt('git', []),
+        removes: [],
+    },
+    nodejs: {
+        packageName: 'nodejs',
+        versionCommand: 'node --version',
+        installCommand: 'apt-get install -y nodejs npm',
+        // Globally installed packages live here, pm2 among them.
+        uninstallCommand: apt('nodejs npm', ['/usr/lib/node_modules', '"$HOME"/.npm']),
+        removes: ['/usr/lib/node_modules (all global npm packages, including PM2)', '~/.npm'],
+    },
+    redis: {
+        packageName: 'redis',
+        versionCommand: 'redis-server --version',
+        installCommand: 'apt-get install -y redis-server',
+        uninstallCommand: apt('redis-server redis-tools', [
+            '/etc/redis',
+            '/var/lib/redis',
+            '/var/log/redis',
+        ]),
+        removes: ['/etc/redis', '/var/lib/redis (persisted keys)', '/var/log/redis'],
+    },
+    ufw: {
+        packageName: 'ufw',
+        versionCommand: 'ufw --version',
+        installCommand: 'apt-get install -y ufw',
+        uninstallCommand: apt('ufw', ['/etc/ufw', '/lib/ufw']),
+        removes: ['/etc/ufw (all firewall rules)', '/lib/ufw'],
+    },
+    fail2ban: {
+        packageName: 'fail2ban',
+        versionCommand: 'fail2ban-client --version',
+        installCommand: 'apt-get install -y fail2ban',
+        uninstallCommand: apt('fail2ban', [
+            '/etc/fail2ban',
+            '/var/lib/fail2ban',
+            '/var/log/fail2ban.log',
+        ]),
+        removes: ['/etc/fail2ban (jails and filters)', '/var/lib/fail2ban (ban database)'],
+    },
+    htop: {
+        packageName: 'htop',
+        versionCommand: 'htop --version',
+        installCommand: 'apt-get install -y htop',
+        uninstallCommand: apt('htop', []),
+        removes: [],
+    },
+};
+exports.DEPENDENCY_NAMES = Object.keys(exports.PACKAGES);

package/dist/services/s3.d.ts

@@ -0,0 +1,17 @@
+import { S3Client } from '@aws-sdk/client-s3';
+import type { S3Config } from './backup-config';
+export interface S3BackupEntry {
+    key: string;
+    size: number;
+    lastModified: Date;
+}
+export declare function createS3Client(config: S3Config): S3Client;
+export declare function backupS3Key(engine: string, dbName: string, timestamp: string): string;
+export declare function backupPrefix(engine: string, dbName: string): string;
+export declare function uploadToS3(s3Config: S3Config, localPath: string, s3Key: string): Promise<{
+    key: string;
+}>;
+export declare function listS3Backups(s3Config: S3Config, engine: string, dbName: string): Promise<S3BackupEntry[]>;
+export declare function downloadFromS3(s3Config: S3Config, s3Key: string, localPath: string): Promise<void>;
+export declare function deleteFromS3(s3Config: S3Config, s3Key: string): Promise<void>;
+export declare function enforceRetention(s3Config: S3Config, engine: string, dbName: string, retention: number): Promise<void>;