easy-vps 0.1.0

package/dist/services/s3.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createS3Client = createS3Client;
+exports.backupS3Key = backupS3Key;
+exports.backupPrefix = backupPrefix;
+exports.uploadToS3 = uploadToS3;
+exports.listS3Backups = listS3Backups;
+exports.downloadFromS3 = downloadFromS3;
+exports.deleteFromS3 = deleteFromS3;
+exports.enforceRetention = enforceRetention;
+// S3-compatible storage operations for backup uploads/downloads.
+const client_s3_1 = require("@aws-sdk/client-s3");
+const node_fs_1 = require("node:fs");
+const BACKUP_PREFIX = 'easy-vps/backups/database';
+function createS3Client(config) {
+    return new client_s3_1.S3Client({
+        region: config.region,
+        endpoint: config.region.includes('.') ? undefined : `https://s3.${config.region}.amazonaws.com`,
+        credentials: {
+            accessKeyId: config.accessKey,
+            secretAccessKey: config.secretKey,
+        },
+        forcePathStyle: false,
+    });
+}
+function backupS3Key(engine, dbName, timestamp) {
+    return `${BACKUP_PREFIX}/${engine}/${dbName}/${timestamp}/backup.dmp`;
+}
+function backupPrefix(engine, dbName) {
+    return `${BACKUP_PREFIX}/${engine}/${dbName}/`;
+}
+async function uploadToS3(s3Config, localPath, s3Key) {
+    const client = createS3Client(s3Config);
+    const body = (0, node_fs_1.readFileSync)(localPath);
+    await client.send(new client_s3_1.PutObjectCommand({
+        Bucket: s3Config.bucket,
+        Key: s3Key,
+        Body: body,
+    }));
+    return { key: s3Key };
+}
+async function listS3Backups(s3Config, engine, dbName) {
+    const client = createS3Client(s3Config);
+    const prefix = backupPrefix(engine, dbName);
+    const result = await client.send(new client_s3_1.ListObjectsV2Command({
+        Bucket: s3Config.bucket,
+        Prefix: prefix,
+    }));
+    return (result.Contents ?? [])
+        .filter((obj) => obj.Key && obj.Key.endsWith('backup.dmp'))
+        .map((obj) => ({
+        key: obj.Key,
+        size: obj.Size ?? 0,
+        lastModified: obj.LastModified ?? new Date(),
+    }))
+        .sort((a, b) => b.lastModified.getTime() - a.lastModified.getTime());
+}
+async function downloadFromS3(s3Config, s3Key, localPath) {
+    const client = createS3Client(s3Config);
+    const result = await client.send(new client_s3_1.GetObjectCommand({
+        Bucket: s3Config.bucket,
+        Key: s3Key,
+    }));
+    const stream = result.Body;
+    if (!stream)
+        throw new Error('Empty response from S3');
+    const chunks = [];
+    const reader = stream.transformToWebStream().getReader();
+    let done = false;
+    while (!done) {
+        const { value, done: readerDone } = await reader.read();
+        done = readerDone;
+        if (value)
+            chunks.push(value);
+    }
+    (0, node_fs_1.writeFileSync)(localPath, Buffer.concat(chunks));
+}
+async function deleteFromS3(s3Config, s3Key) {
+    const client = createS3Client(s3Config);
+    await client.send(new client_s3_1.DeleteObjectCommand({
+        Bucket: s3Config.bucket,
+        Key: s3Key,
+    }));
+}
+async function enforceRetention(s3Config, engine, dbName, retention) {
+    const backups = await listS3Backups(s3Config, engine, dbName);
+    if (backups.length <= retention)
+        return;
+    const toDelete = backups.slice(retention);
+    for (const backup of toDelete) {
+        await deleteFromS3(s3Config, backup.key);
+    }
+}

package/dist/services/ssh.d.ts

@@ -0,0 +1,78 @@
+export declare class RemoteError extends Error {
+}
+export interface Credentials {
+    host: string;
+    port: number;
+    username: string;
+    password?: string;
+    privateKey?: string;
+    passphrase?: string;
+}
+export interface ExecResult {
+    stdout: string;
+    stderr: string;
+    code: number;
+}
+export interface StreamHandlers {
+    onOutput: (line: string) => void;
+    onDone: () => void;
+    onError: (message: string) => void;
+}
+/** Wraps a value for safe interpolation into a remote /bin/sh command line. */
+export declare function quote(value: string): string;
+/**
+ * Runs a command through a login shell so it sees the PATH the server's own
+ * profile sets up. Without this, tools installed outside the system prefix —
+ * nvm's node/npm, and pm2 alongside them — are invisible to `ssh host cmd`,
+ * because that runs a non-interactive, non-login shell.
+ */
+export declare function loginShell(command: string): string;
+/**
+ * One managed VPS, bound to a logged-in session. Holds a single SSH connection
+ * and reopens it transparently if the server drops it while the session is idle.
+ */
+export declare class Remote {
+    private readonly credentials;
+    private client;
+    private pending;
+    private cachedUid;
+    private active;
+    private readonly waiting;
+    constructor(credentials: Credentials);
+    get host(): string;
+    get username(): string;
+    get creds(): Credentials;
+    private open;
+    /** A ready connection, reused across calls and shared by concurrent ones. */
+    private connection;
+    /** Waits for a free channel slot; returns the function that releases it. */
+    private acquire;
+    private channel;
+    /**
+     * Runs a command to completion. Always resolves with the exit code — callers
+     * decide what a non-zero status means. The timeout keeps a wedged binary on
+     * the server from hanging an HTTP request indefinitely.
+     */
+    exec(command: string, timeoutMs?: number): Promise<ExecResult>;
+    /** Like exec(), but throws when the command fails. */
+    execOrThrow(command: string, timeoutMs?: number): Promise<string>;
+    /** Streams a long-running command line by line. Returns a cancel function. */
+    execStream(command: string, handlers: StreamHandlers): () => void;
+    /** Numeric uid of the logged-in remote user; 0 means the panel can act unprivileged. */
+    uid(): Promise<number>;
+    isRoot(): Promise<boolean>;
+    /** Prefixes a command with non-interactive sudo unless already root. */
+    privileged(command: string): Promise<string>;
+    readFile(remotePath: string): Promise<string>;
+    /** Writes via `tee` so the same sudo path covers root-owned destinations. */
+    writeFile(remotePath: string, contents: string): Promise<void>;
+    exists(remotePath: string): Promise<boolean>;
+    /** Directory entries, or an empty list when the directory is absent. */
+    listDir(remotePath: string): Promise<string[]>;
+    remove(remotePath: string): Promise<void>;
+    symlink(target: string, linkPath: string): Promise<void>;
+    close(): void;
+}
+export declare function createSession(id: string, credentials: Credentials): Remote;
+export declare function getSession(id: string): Remote | null;
+export declare function destroySession(id: string): void;

package/dist/services/ssh.js

@@ -0,0 +1,309 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Remote = exports.RemoteError = void 0;
+exports.quote = quote;
+exports.loginShell = loginShell;
+exports.createSession = createSession;
+exports.getSession = getSession;
+exports.destroySession = destroySession;
+// Runs commands on the managed VPS over SSH. Every operation the panel performs
+// on the server goes through here — the panel process itself never installs
+// packages or writes config on the machine it happens to be running on.
+const ssh2_1 = require("ssh2");
+class RemoteError extends Error {
+}
+exports.RemoteError = RemoteError;
+const CONNECT_TIMEOUT_MS = 8000;
+const DEFAULT_EXEC_TIMEOUT_MS = 30_000;
+// sshd allows a limited number of concurrent channels per connection
+// (MaxSessions, 10 by default) and rejects the rest with "open failed".
+// Short-lived exec() calls queue behind this so a wide Promise.all — ten
+// dependency probes at once — cannot exhaust the connection.
+const MAX_CONCURRENT_EXECS = 4;
+/** Wraps a value for safe interpolation into a remote /bin/sh command line. */
+function quote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/**
+ * Runs a command through a login shell so it sees the PATH the server's own
+ * profile sets up. Without this, tools installed outside the system prefix —
+ * nvm's node/npm, and pm2 alongside them — are invisible to `ssh host cmd`,
+ * because that runs a non-interactive, non-login shell.
+ */
+function loginShell(command) {
+    return `bash -lc ${quote(command)}`;
+}
+function emitLines(chunk, onOutput) {
+    for (const line of chunk.toString('utf8').split('\n')) {
+        if (line.trim())
+            onOutput(line);
+    }
+}
+/** `sudo -n` fails loudly rather than hanging on a password prompt; say so usefully. */
+function sudoFailure(stderr, username) {
+    if (/sudo: a (password|terminal) is required|sudo: no tty/i.test(stderr)) {
+        return `Passwordless sudo is not enabled for "${username}" on this server. Enable it, or log in as root.`;
+    }
+    if (/is not in the sudoers file/i.test(stderr)) {
+        return `"${username}" is not permitted to use sudo on this server. Log in as root instead.`;
+    }
+    return null;
+}
+/**
+ * One managed VPS, bound to a logged-in session. Holds a single SSH connection
+ * and reopens it transparently if the server drops it while the session is idle.
+ */
+class Remote {
+    credentials;
+    client = null;
+    pending = null;
+    cachedUid = null;
+    active = 0;
+    waiting = [];
+    constructor(credentials) {
+        this.credentials = credentials;
+    }
+    get host() {
+        return this.credentials.host;
+    }
+    get username() {
+        return this.credentials.username;
+    }
+    get creds() {
+        return this.credentials;
+    }
+    open() {
+        return new Promise((resolve, reject) => {
+            const client = new ssh2_1.Client();
+            const timer = setTimeout(() => {
+                client.end();
+                reject(new RemoteError('SSH handshake timed out'));
+            }, CONNECT_TIMEOUT_MS);
+            client
+                .on('ready', () => {
+                clearTimeout(timer);
+                this.client = client;
+                resolve(client);
+            })
+                .on('error', (error) => {
+                clearTimeout(timer);
+                this.client = null;
+                reject(new RemoteError(error.message));
+            })
+                .on('close', () => {
+                // Next call reconnects rather than writing to a dead channel.
+                this.client = null;
+            })
+                .connect({
+                host: this.credentials.host,
+                port: this.credentials.port,
+                username: this.credentials.username,
+                password: this.credentials.password,
+                privateKey: this.credentials.privateKey,
+                passphrase: this.credentials.passphrase,
+                readyTimeout: CONNECT_TIMEOUT_MS,
+                keepaliveInterval: 15_000,
+            });
+        });
+    }
+    /** A ready connection, reused across calls and shared by concurrent ones. */
+    async connection() {
+        if (this.client)
+            return this.client;
+        this.pending ??= this.open().finally(() => {
+            this.pending = null;
+        });
+        return this.pending;
+    }
+    /** Waits for a free channel slot; returns the function that releases it. */
+    async acquire() {
+        if (this.active >= MAX_CONCURRENT_EXECS) {
+            await new Promise((resolve) => this.waiting.push(resolve));
+        }
+        this.active += 1;
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            this.active -= 1;
+            this.waiting.shift()?.();
+        };
+    }
+    async channel(command) {
+        const client = await this.connection();
+        return new Promise((resolve, reject) => {
+            client.exec(command, (error, stream) => {
+                if (error)
+                    reject(new RemoteError(error.message));
+                else
+                    resolve(stream);
+            });
+        });
+    }
+    /**
+     * Runs a command to completion. Always resolves with the exit code — callers
+     * decide what a non-zero status means. The timeout keeps a wedged binary on
+     * the server from hanging an HTTP request indefinitely.
+     */
+    async exec(command, timeoutMs = DEFAULT_EXEC_TIMEOUT_MS) {
+        const release = await this.acquire();
+        try {
+            const stream = await this.channel(command);
+            return await new Promise((resolve, reject) => {
+                let stdout = '';
+                let stderr = '';
+                const timer = setTimeout(() => {
+                    stream.close();
+                    reject(new RemoteError(`Timed out after ${Math.round(timeoutMs / 1000)}s: ${command}`));
+                }, timeoutMs);
+                stream.on('data', (chunk) => {
+                    stdout += chunk.toString('utf8');
+                });
+                stream.stderr.on('data', (chunk) => {
+                    stderr += chunk.toString('utf8');
+                });
+                stream.on('close', (code) => {
+                    clearTimeout(timer);
+                    resolve({ stdout, stderr, code: code ?? 0 });
+                });
+                stream.on('error', (error) => {
+                    clearTimeout(timer);
+                    reject(new RemoteError(error.message));
+                });
+            });
+        }
+        finally {
+            release();
+        }
+    }
+    /** Like exec(), but throws when the command fails. */
+    async execOrThrow(command, timeoutMs) {
+        const result = await this.exec(command, timeoutMs);
+        if (result.code !== 0) {
+            const detail = result.stderr.trim() || `Command failed: ${command}`;
+            throw new RemoteError(sudoFailure(result.stderr, this.username) ?? detail);
+        }
+        return result.stdout;
+    }
+    /** Streams a long-running command line by line. Returns a cancel function. */
+    execStream(command, handlers) {
+        let cancelled = false;
+        let stream = null;
+        void this.channel(command)
+            .then((channel) => {
+            if (cancelled) {
+                channel.close();
+                return;
+            }
+            stream = channel;
+            channel.on('data', (chunk) => emitLines(chunk, handlers.onOutput));
+            channel.stderr.on('data', (chunk) => emitLines(chunk, handlers.onOutput));
+            channel.on('close', (code) => {
+                if (cancelled)
+                    return;
+                if (code === 0)
+                    handlers.onDone();
+                else
+                    handlers.onError(`Command exited with code ${code ?? 'unknown'}`);
+            });
+            channel.on('error', (error) => {
+                if (!cancelled)
+                    handlers.onError(error.message);
+            });
+        })
+            .catch((error) => {
+            if (!cancelled)
+                handlers.onError(error.message);
+        });
+        return () => {
+            cancelled = true;
+            stream?.close();
+        };
+    }
+    /** Numeric uid of the logged-in remote user; 0 means the panel can act unprivileged. */
+    async uid() {
+        if (this.cachedUid !== null)
+            return this.cachedUid;
+        const { stdout } = await this.exec('id -u', 10_000);
+        const uid = Number(stdout.trim());
+        this.cachedUid = Number.isInteger(uid) ? uid : -1;
+        return this.cachedUid;
+    }
+    async isRoot() {
+        return (await this.uid()) === 0;
+    }
+    /** Prefixes a command with non-interactive sudo unless already root. */
+    async privileged(command) {
+        return (await this.isRoot()) ? command : `sudo -n ${command}`;
+    }
+    async readFile(remotePath) {
+        return this.execOrThrow(await this.privileged(`cat ${quote(remotePath)}`));
+    }
+    /** Writes via `tee` so the same sudo path covers root-owned destinations. */
+    async writeFile(remotePath, contents) {
+        const command = await this.privileged(`tee ${quote(remotePath)} > /dev/null`);
+        const release = await this.acquire();
+        const stream = await this.channel(command).catch((error) => {
+            release();
+            throw error;
+        });
+        await new Promise((resolve, reject) => {
+            let stderr = '';
+            // Both pipes must be drained or the channel never closes and this hangs.
+            stream.on('data', () => undefined);
+            stream.stderr.on('data', (chunk) => {
+                stderr += chunk.toString('utf8');
+            });
+            stream.on('close', (code) => {
+                if (code === 0)
+                    resolve();
+                else {
+                    const detail = stderr.trim() || `Could not write ${remotePath}`;
+                    reject(new RemoteError(sudoFailure(stderr, this.username) ?? detail));
+                }
+            });
+            stream.on('error', (error) => reject(new RemoteError(error.message)));
+            stream.end(contents);
+        }).finally(release);
+    }
+    async exists(remotePath) {
+        const command = await this.privileged(`test -e ${quote(remotePath)}`);
+        return (await this.exec(command, 10_000)).code === 0;
+    }
+    /** Directory entries, or an empty list when the directory is absent. */
+    async listDir(remotePath) {
+        const command = await this.privileged(`ls -1 ${quote(remotePath)} 2>/dev/null`);
+        const { stdout, code } = await this.exec(command, 10_000);
+        if (code !== 0)
+            return [];
+        return stdout.split('\n').map((line) => line.trim()).filter(Boolean);
+    }
+    async remove(remotePath) {
+        await this.exec(await this.privileged(`rm -f ${quote(remotePath)}`), 10_000);
+    }
+    async symlink(target, linkPath) {
+        await this.execOrThrow(await this.privileged(`ln -sfn ${quote(target)} ${quote(linkPath)}`), 10_000);
+    }
+    close() {
+        this.client?.end();
+        this.client = null;
+    }
+}
+exports.Remote = Remote;
+// Live sessions, keyed by the id carried in the session cookie. Credentials stay
+// in this process only: a restart empties the map and everyone logs in again.
+const sessions = new Map();
+function createSession(id, credentials) {
+    sessions.get(id)?.close();
+    const remote = new Remote(credentials);
+    sessions.set(id, remote);
+    return remote;
+}
+function getSession(id) {
+    return sessions.get(id) ?? null;
+}
+function destroySession(id) {
+    sessions.get(id)?.close();
+    sessions.delete(id);
+}

package/dist/services/system.d.ts

@@ -0,0 +1,74 @@
+import { type DependencyName } from './packages';
+import { type Remote, type StreamHandlers } from './ssh';
+export type { DependencyName } from './packages';
+export { PACKAGES } from './packages';
+export type PackageAction = 'install' | 'uninstall';
+export interface DependencyStatus {
+    name: DependencyName;
+    installed: boolean;
+    version: string | null;
+    /** Paths its uninstall deletes, so the UI can warn before running it. */
+    removes: string[];
+}
+export interface CpuInfo {
+    model: string;
+    cores: number;
+    usagePercent: number;
+}
+export interface MemoryInfo {
+    totalMb: number;
+    usedMb: number;
+    freeMb: number;
+    availableMb: number;
+    usagePercent: number;
+}
+export interface DiskInfo {
+    totalGb: number;
+    usedGb: number;
+    freeGb: number;
+    usagePercent: number;
+}
+export interface SwapInfo {
+    totalMb: number;
+    usedMb: number;
+    freeMb: number;
+    usagePercent: number;
+}
+export interface LoadAverage {
+    one: number;
+    five: number;
+    fifteen: number;
+}
+export interface NetworkInfo {
+    rxMb: number;
+    txMb: number;
+}
+export interface TopProcess {
+    name: string;
+    cpu: number;
+    memory: number;
+    pid: number;
+}
+export interface SystemMetrics {
+    cpu: CpuInfo;
+    memory: MemoryInfo;
+    disk: DiskInfo;
+    swap: SwapInfo;
+    uptime: string;
+    uptimeSeconds: number;
+    loadAverage: LoadAverage;
+    network: NetworkInfo;
+    topProcesses: TopProcess[];
+}
+/** Collect comprehensive system metrics from the VPS. */
+export declare function getMetrics(remote: Remote): Promise<SystemMetrics>;
+/** Detect whether a dependency is present on the VPS. */
+export declare function detect(remote: Remote, name: DependencyName): Promise<DependencyStatus>;
+export declare function detectAll(remote: Remote): Promise<DependencyStatus[]>;
+/** True when the logged-in remote user can run privileged commands unattended. */
+export declare function canAdminister(remote: Remote): Promise<boolean>;
+/**
+ * Installs or removes a dependency on the VPS, streaming stdout/stderr line by
+ * line. Returns a function that cancels the run in progress.
+ */
+export declare function packageStream(remote: Remote, name: DependencyName, action: PackageAction, handlers: StreamHandlers): () => void;