eoas 3.0.5 → 3.1.0

package/dist/commands/server/init.js

@@ -0,0 +1,654 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readExistingMasterKey = void 0;
+const tslib_1 = require("tslib");
+const core_1 = require("@oclif/core");
+const chalk_1 = tslib_1.__importDefault(require("chalk"));
+const crypto_1 = require("crypto");
+const fs_extra_1 = tslib_1.__importDefault(require("fs-extra"));
+const path_1 = tslib_1.__importDefault(require("path"));
+const log_1 = tslib_1.__importDefault(require("../../lib/log"));
+const prompts_1 = require("../../lib/prompts");
+const choices_1 = require("../../lib/serverConfig/choices");
+const envCatalog_1 = require("../../lib/serverConfig/envCatalog");
+const helmValues_1 = require("../../lib/serverConfig/helmValues");
+const passwordPolicy_1 = require("../../lib/serverConfig/passwordPolicy");
+const utils_1 = require("../../lib/utils");
+const DOCKER_IMAGE = 'ghcr.io/mercuretechnologies/xprem:latest';
+const HELM_CHART = 'oci://ghcr.io/mercuretechnologies/charts/xprem';
+const ACCENT = chalk_1.default.hex('#818cf8');
+const BADGE = chalk_1.default.bgHex('#4f46e5').white.bold;
+const ENV_FILE_NAME = '.env.xprem';
+const HELM_OUT_DIR = 'xprem-helm';
+const MASTER_KEY_VAR = 'DB_KEYS_MASTER_KEY_B64';
+const SECRET_FILE_MODE = 0o600;
+const SECRET_FILE_REASON = 'Generated by eoas server:init, holds server secrets';
+function generateSecret() {
+    return (0, crypto_1.randomBytes)(32).toString('base64');
+}
+// writeFile only applies mode when it creates the file, so an existing one
+// would keep whatever permissions it already had.
+async function writeSecretFile(filePath, content) {
+    await fs_extra_1.default.remove(filePath);
+    await fs_extra_1.default.writeFile(filePath, content, { mode: SECRET_FILE_MODE });
+}
+// The master key seals the OTA signing keys and the OIDC client secret already
+// in the database, so a re-run reuses it instead of minting a new one.
+async function readExistingMasterKey(deployment) {
+    const filePath = deployment === 'helm'
+        ? path_1.default.resolve(process.cwd(), HELM_OUT_DIR, helmValues_1.HELM_SECRETS_FILE)
+        : path_1.default.resolve(process.cwd(), ENV_FILE_NAME);
+    if (!(await fs_extra_1.default.pathExists(filePath))) {
+        return { unreadable: false };
+    }
+    try {
+        const content = await fs_extra_1.default.readFile(filePath, 'utf8');
+        const env = deployment === 'helm' ? (0, helmValues_1.extractSecretEnv)((0, helmValues_1.parseYamlFile)(content)) : (0, envCatalog_1.parseEnvFile)(content);
+        const key = env?.[MASTER_KEY_VAR];
+        if (!key || (0, envCatalog_1.isPlaceholder)(key)) {
+            return { unreadable: false };
+        }
+        return { key, unreadable: false };
+    }
+    catch {
+        return { unreadable: true };
+    }
+}
+exports.readExistingMasterKey = readExistingMasterKey;
+function isHttpUrl(value) {
+    try {
+        const url = new URL(value);
+        return url.protocol === 'http:' || url.protocol === 'https:';
+    }
+    catch {
+        return false;
+    }
+}
+function shortPasswordHint(missing) {
+    const short = missing.map(rule => rule
+        .replace('at least 8 characters', '8+ chars')
+        .replace('an uppercase letter', 'uppercase')
+        .replace('a lowercase letter', 'lowercase')
+        .replace('a digit', 'digit')
+        .replace('a special character', 'special char'));
+    return `Missing: ${short.join(', ')}`;
+}
+const AWS_AUTH_CHOICES = [
+    {
+        title: 'IAM role',
+        value: 'iam-role',
+        description: 'role on the runtime, no keys in the env',
+    },
+    {
+        title: 'Access key pair in the env',
+        value: 'access-keys',
+        description: 'AWS_ACCESS_KEY_ID + SECRET in the env',
+    },
+];
+const STORAGE_CHOICES = [
+    { title: 'AWS S3', value: { storage: 'aws-s3' } },
+    ...Object.keys(choices_1.S3_PROVIDER_DEFAULTS).map(provider => ({
+        title: choices_1.S3_PROVIDER_DEFAULTS[provider].label,
+        value: { storage: 's3-compatible', provider },
+        description: 'S3-compatible',
+    })),
+    { title: 'Google Cloud Storage', value: { storage: 'gcs' } },
+    { title: 'Azure Blob Storage', value: { storage: 'azure' } },
+];
+const DELIVERY_CHOICES = {
+    cloudfront: {
+        title: 'CloudFront',
+        description: 'signed URLs, the bucket stays private',
+    },
+    presigned: {
+        title: 'Pre-signed storage URLs',
+        description: 'signed URLs straight to the private bucket',
+    },
+    'through-server': {
+        title: 'Through the server',
+        description: 'the server streams assets, costs bandwidth',
+    },
+    'generic-cdn': {
+        title: 'Generic CDN',
+        description: 'a CDN in front of a public bucket',
+    },
+};
+function summaryLines(state) {
+    const storageChoice = STORAGE_CHOICES.find(choice => choice.value === state.storagePick);
+    const set = ACCENT;
+    const later = chalk_1.default.dim('to fill later');
+    const rows = [
+        ['Base URL', state.baseUrl ? set(state.baseUrl) : later],
+        ['JWT secret', state.jwtSecret ? set('generated') : later],
+        ['PostgreSQL', state.dbUrl ? set(state.dbUrl) : later],
+        ['Master key', set('generated, keep a backup')],
+        [
+            'Storage',
+            set(storageChoice?.title ?? 'AWS S3') +
+                (state.awsAuth
+                    ? chalk_1.default.dim(` · ${state.awsAuth === 'iam-role' ? 'IAM role' : 'access keys'}`)
+                    : ''),
+        ],
+        ['Delivery', set(DELIVERY_CHOICES[state.delivery ?? 'presigned'].title)],
+        ['Replicas', set(state.multiReplica ? 'multiple' : 'single')],
+        ['Cache', set(state.cacheMode ?? 'local')],
+        ['Dashboard admin', state.adminEmail ? set(state.adminEmail) : later],
+        ['Observe', state.observe ? set('on') : chalk_1.default.dim('off')],
+        [
+            'Geolocation',
+            state.geoip
+                ? set(state.geoipStrategy === 'maxmind' ? 'MaxMind GeoLite2' : 'proxy headers')
+                : chalk_1.default.dim('off'),
+        ],
+        [
+            'Deployment',
+            set(state.deployment === 'helm'
+                ? 'Helm (values.yaml + secrets.yaml)'
+                : state.deployment === 'binary'
+                    ? 'Binary (.env.xprem)'
+                    : 'Docker (.env.xprem)'),
+        ],
+    ];
+    return rows.map(([label, value]) => `${label.padEnd(16)}${value}`).join('\n');
+}
+class ServerInit extends core_1.Command {
+    static args = {};
+    static description = 'Interactive wizard that generates a pre-filled server configuration: .env.xprem for Docker or a binary, xprem-helm/ (values.yaml + secrets.yaml) for Helm';
+    static examples = ['<%= config.bin %> <%= command.id %>'];
+    static flags = {};
+    async run() {
+        log_1.default.intro(`${BADGE(' xprem ')} ${chalk_1.default.bold('server setup')} ${chalk_1.default.dim('· control plane')}`);
+        log_1.default.gray('Answers shape the generated config; skipped secrets stay as <placeholders>.');
+        log_1.default.gray(`Pick "← Back" in a list, or type "${prompts_1.BACK_INPUT}" in a text answer, to go back one step.`);
+        const state = {};
+        const steps = [
+            {
+                id: 'base-url',
+                run: async () => {
+                    const value = await (0, prompts_1.textStep)('Public HTTPS URL of the server', {
+                        optional: true,
+                        initial: state.baseUrl,
+                        validate: v => isHttpUrl(v) || 'Must be a valid http(s) URL',
+                    });
+                    if (value === prompts_1.BACK) {
+                        return 'back';
+                    }
+                    state.baseUrl = value;
+                    return 'next';
+                },
+            },
+            {
+                id: 'jwt',
+                run: async (allowBack) => {
+                    while (true) {
+                        const mode = await (0, prompts_1.selectStep)('JWT secret (signs sessions and upload tokens)', [
+                            { title: 'Generate one now', value: 'generate' },
+                            { title: 'Paste my own', value: 'provide' },
+                            { title: 'Set it later', value: 'later' },
+                        ], { allowBack });
+                        if (mode === prompts_1.BACK) {
+                            return 'back';
+                        }
+                        if (mode === 'generate') {
+                            state.jwtSecret = generateSecret();
+                            log_1.default.succeed('JWT secret generated.');
+                        }
+                        else if (mode === 'provide') {
+                            const value = await (0, prompts_1.textStep)('JWT secret', { secret: true, allowBack: true });
+                            if (value === prompts_1.BACK) {
+                                continue;
+                            }
+                            state.jwtSecret = value;
+                        }
+                        else {
+                            state.jwtSecret = undefined;
+                        }
+                        return 'next';
+                    }
+                },
+            },
+            {
+                id: 'db-url',
+                run: async (allowBack) => {
+                    const value = await (0, prompts_1.textStep)('PostgreSQL connection string', {
+                        optional: true,
+                        allowBack,
+                        initial: state.dbUrl,
+                    });
+                    if (value === prompts_1.BACK) {
+                        return 'back';
+                    }
+                    state.dbUrl = value;
+                    return 'next';
+                },
+            },
+            {
+                id: 'storage',
+                run: async (allowBack) => {
+                    const pick = await (0, prompts_1.selectStep)('Where are the published updates stored?', STORAGE_CHOICES, {
+                        allowBack,
+                        initial: state.storagePick,
+                    });
+                    if (pick === prompts_1.BACK) {
+                        return 'back';
+                    }
+                    state.storagePick = pick;
+                    return 'next';
+                },
+            },
+            {
+                id: 'storage-details',
+                run: async () => {
+                    const pick = state.storagePick ?? { storage: 'aws-s3' };
+                    if (pick.storage === 'aws-s3') {
+                        const auth = await (0, prompts_1.selectStep)('How does the server authenticate against S3?', AWS_AUTH_CHOICES, { allowBack: true, initial: state.awsAuth });
+                        if (auth === prompts_1.BACK) {
+                            return 'back';
+                        }
+                        state.awsAuth = auth;
+                        const bucket = await (0, prompts_1.textStep)('S3 bucket name', {
+                            optional: true,
+                            allowBack: true,
+                            initial: state.s3BucketName,
+                        });
+                        if (bucket === prompts_1.BACK) {
+                            return 'back';
+                        }
+                        state.s3BucketName = bucket;
+                        const region = await (0, prompts_1.textStep)('AWS region', {
+                            optional: true,
+                            allowBack: true,
+                            initial: state.awsRegion ?? 'eu-west-1',
+                        });
+                        if (region === prompts_1.BACK) {
+                            return 'back';
+                        }
+                        state.awsRegion = region;
+                    }
+                    else if (pick.storage === 's3-compatible' && pick.provider) {
+                        const defaults = choices_1.S3_PROVIDER_DEFAULTS[pick.provider];
+                        const endpoint = await (0, prompts_1.textStep)("Provider's S3 endpoint", {
+                            optional: true,
+                            allowBack: true,
+                            initial: state.awsBaseEndpoint ?? defaults.endpoint,
+                        });
+                        if (endpoint === prompts_1.BACK) {
+                            return 'back';
+                        }
+                        state.awsBaseEndpoint = endpoint;
+                        const region = await (0, prompts_1.textStep)('Region', {
+                            optional: true,
+                            allowBack: true,
+                            initial: state.awsRegion ?? defaults.region,
+                        });
+                        if (region === prompts_1.BACK) {
+                            return 'back';
+                        }
+                        state.awsRegion = region;
+                        const bucket = await (0, prompts_1.textStep)('Bucket name', {
+                            optional: true,
+                            allowBack: true,
+                            initial: state.s3BucketName,
+                        });
+                        if (bucket === prompts_1.BACK) {
+                            return 'back';
+                        }
+                        state.s3BucketName = bucket;
+                    }
+                    else if (pick.storage === 'gcs') {
+                        const bucket = await (0, prompts_1.textStep)('GCS bucket name', {
+                            optional: true,
+                            allowBack: true,
+                            initial: state.gcsBucketName,
+                        });
+                        if (bucket === prompts_1.BACK) {
+                            return 'back';
+                        }
+                        state.gcsBucketName = bucket;
+                    }
+                    else {
+                        const container = await (0, prompts_1.textStep)('Blob container name', {
+                            optional: true,
+                            allowBack: true,
+                            initial: state.azureContainerName,
+                        });
+                        if (container === prompts_1.BACK) {
+                            return 'back';
+                        }
+                        state.azureContainerName = container;
+                        const account = await (0, prompts_1.textStep)('Storage account name', {
+                            optional: true,
+                            allowBack: true,
+                            initial: state.azureAccountName,
+                        });
+                        if (account === prompts_1.BACK) {
+                            return 'back';
+                        }
+                        state.azureAccountName = account;
+                    }
+                    return 'next';
+                },
+            },
+            {
+                id: 'delivery',
+                run: async (allowBack) => {
+                    while (true) {
+                        const storage = state.storagePick?.storage ?? 'aws-s3';
+                        const options = (0, choices_1.deliveryOptionsFor)(storage);
+                        const delivery = await (0, prompts_1.selectStep)('How do devices download the update assets?', options.map(option => ({ ...DELIVERY_CHOICES[option], value: option })), {
+                            allowBack,
+                            initial: state.delivery && options.includes(state.delivery) ? state.delivery : undefined,
+                        });
+                        if (delivery === prompts_1.BACK) {
+                            return 'back';
+                        }
+                        state.delivery = delivery;
+                        if (delivery === 'generic-cdn') {
+                            const url = await (0, prompts_1.textStep)('CDN base URL', {
+                                optional: true,
+                                allowBack: true,
+                                initial: state.cdnBaseUrl,
+                            });
+                            if (url === prompts_1.BACK) {
+                                continue;
+                            }
+                            state.cdnBaseUrl = url;
+                        }
+                        return 'next';
+                    }
+                },
+            },
+            {
+                id: 'replicas',
+                run: async (allowBack) => {
+                    const multi = await (0, prompts_1.yesNoStep)('Will you run more than one replica of the server?', {
+                        allowBack,
+                        initial: state.multiReplica ?? false,
+                    });
+                    if (multi === prompts_1.BACK) {
+                        return 'back';
+                    }
+                    state.multiReplica = multi;
+                    if (multi && state.cacheMode === 'local') {
+                        state.cacheMode = undefined;
+                    }
+                    return 'next';
+                },
+            },
+            {
+                id: 'cache',
+                run: async (allowBack) => {
+                    const replicas = state.multiReplica ? 'multi' : 'single';
+                    const cacheMode = await (0, prompts_1.selectStep)(state.multiReplica ? 'Which shared cache? (required with replicas)' : 'Which cache?', (0, choices_1.cacheOptionsFor)(replicas).map(option => option === 'redis'
+                        ? { title: 'Redis', value: option }
+                        : option === 'redis-sentinel'
+                            ? { title: 'Redis Sentinel', value: option }
+                            : {
+                                title: 'In-memory',
+                                value: option,
+                                description: 'single replica only',
+                            }), { allowBack, initial: state.cacheMode });
+                    if (cacheMode === prompts_1.BACK) {
+                        return 'back';
+                    }
+                    state.cacheMode = cacheMode;
+                    return 'next';
+                },
+            },
+            {
+                id: 'admin',
+                run: async () => {
+                    while (true) {
+                        const email = await (0, prompts_1.textStep)('Dashboard admin email (seeded at first boot)', {
+                            allowBack: true,
+                            initial: state.adminEmail,
+                            validate: v => /^\S+@\S+\.\S+$/.test(v) || 'Must be an email address',
+                        });
+                        if (email === prompts_1.BACK) {
+                            return 'back';
+                        }
+                        state.adminEmail = email;
+                        const password = await (0, prompts_1.textStep)('Admin password', {
+                            secret: true,
+                            allowBack: true,
+                            validate: v => {
+                                const missing = (0, passwordPolicy_1.missingPasswordRules)(v);
+                                return missing.length === 0 || shortPasswordHint(missing);
+                            },
+                        });
+                        if (password === prompts_1.BACK) {
+                            continue;
+                        }
+                        state.adminPassword = password;
+                        return 'next';
+                    }
+                },
+            },
+            {
+                id: 'deployment',
+                run: async (allowBack) => {
+                    const deployment = await (0, prompts_1.selectStep)('How will you deploy the server?', [
+                        { title: 'Docker', value: 'docker', description: 'generates .env.xprem' },
+                        { title: 'Binary', value: 'binary', description: 'generates .env.xprem' },
+                        {
+                            title: 'Helm (Kubernetes)',
+                            value: 'helm',
+                            description: 'generates xprem-helm/ (values + secrets)',
+                        },
+                    ], { allowBack, initial: state.deployment });
+                    if (deployment === prompts_1.BACK) {
+                        return 'back';
+                    }
+                    state.deployment = deployment;
+                    return 'next';
+                },
+            },
+            {
+                id: 'observe',
+                run: async (allowBack) => {
+                    while (true) {
+                        const observe = await (0, prompts_1.yesNoStep)('Enable Observe (device metrics, needs ClickHouse)?', {
+                            allowBack,
+                            initial: state.observe ?? false,
+                        });
+                        if (observe === prompts_1.BACK) {
+                            return 'back';
+                        }
+                        state.observe = observe;
+                        if (observe) {
+                            const url = await (0, prompts_1.textStep)('ClickHouse URL', {
+                                optional: true,
+                                allowBack: true,
+                                initial: state.clickhouseUrl,
+                            });
+                            if (url === prompts_1.BACK) {
+                                continue;
+                            }
+                            state.clickhouseUrl = url;
+                        }
+                        return 'next';
+                    }
+                },
+            },
+            {
+                id: 'geoip',
+                run: async (allowBack) => {
+                    while (true) {
+                        const geoip = await (0, prompts_1.yesNoStep)('Locate devices on the Identity dashboard?', {
+                            allowBack,
+                            initial: state.geoip ?? false,
+                        });
+                        if (geoip === prompts_1.BACK) {
+                            return 'back';
+                        }
+                        state.geoip = geoip;
+                        if (!geoip) {
+                            return 'next';
+                        }
+                        const strategy = await (0, prompts_1.selectStep)('How should devices be located?', [
+                            {
+                                title: 'Proxy or CDN headers',
+                                description: 'your edge (Cloudflare, CloudFront...) sends the location',
+                                value: 'proxy-headers',
+                            },
+                            {
+                                title: 'MaxMind GeoLite2',
+                                description: 'the server downloads the free GeoIP database itself',
+                                value: 'maxmind',
+                            },
+                        ], { allowBack: true, initial: state.geoipStrategy });
+                        if (strategy === prompts_1.BACK) {
+                            continue;
+                        }
+                        state.geoipStrategy = strategy;
+                        if (strategy === 'maxmind') {
+                            const accountId = await (0, prompts_1.textStep)('MaxMind account ID', {
+                                optional: true,
+                                allowBack: true,
+                                initial: state.maxmindAccountId,
+                            });
+                            if (accountId === prompts_1.BACK) {
+                                continue;
+                            }
+                            state.maxmindAccountId = accountId;
+                            const licenseKey = await (0, prompts_1.textStep)('MaxMind license key', {
+                                optional: true,
+                                allowBack: true,
+                                initial: state.maxmindLicenseKey,
+                            });
+                            if (licenseKey === prompts_1.BACK) {
+                                continue;
+                            }
+                            state.maxmindLicenseKey = licenseKey;
+                        }
+                        return 'next';
+                    }
+                },
+            },
+            {
+                id: 'summary',
+                run: async () => {
+                    log_1.default.note(summaryLines(state), 'Configuration');
+                    const action = await (0, prompts_1.selectStep)('Generate the configuration?', [{ title: 'Generate', value: 'generate' }], { allowBack: true });
+                    return action === prompts_1.BACK ? 'back' : 'next';
+                },
+            },
+        ];
+        let index = 0;
+        while (index < steps.length) {
+            const result = await steps[index].run(index > 0);
+            index = result === 'back' ? Math.max(0, index - 1) : index + 1;
+        }
+        const storagePick = state.storagePick ?? { storage: 'aws-s3' };
+        const deployment = state.deployment ?? 'docker';
+        const existingMasterKey = await readExistingMasterKey(deployment);
+        if (existingMasterKey.unreadable) {
+            log_1.default.warn(`Could not read ${MASTER_KEY_VAR} from the existing configuration.`);
+            const proceed = await (0, prompts_1.confirmStep)(`Generate a new master key? Signing keys and the SSO client secret sealed with the current one become unreadable.`);
+            if (!proceed) {
+                log_1.default.cancel('Aborted, nothing was written.');
+                return;
+            }
+        }
+        const choices = {
+            baseUrl: state.baseUrl,
+            jwtSecret: state.jwtSecret,
+            dbUrl: state.dbUrl,
+            // The wizard always seals the master key in the env; storing it in AWS
+            // Secrets Manager (AWSSM_DB_KEYS_MASTER_KEY_SECRET_ID) is a hand edit.
+            masterKeySource: 'environment',
+            masterKey: existingMasterKey.key ?? generateSecret(),
+            awsAuth: state.awsAuth,
+            storage: storagePick.storage,
+            s3Provider: storagePick.provider,
+            s3BucketName: state.s3BucketName,
+            awsRegion: state.awsRegion,
+            awsBaseEndpoint: state.awsBaseEndpoint,
+            forcePathStyle: storagePick.provider
+                ? choices_1.S3_PROVIDER_DEFAULTS[storagePick.provider].forcePathStyle
+                : undefined,
+            gcsBucketName: state.gcsBucketName,
+            azureContainerName: state.azureContainerName,
+            azureAccountName: state.azureAccountName,
+            delivery: state.delivery ?? 'presigned',
+            cdnBaseUrl: state.cdnBaseUrl,
+            replicas: state.multiReplica ? 'multi' : 'single',
+            cacheMode: state.cacheMode ?? 'local',
+            adminEmail: state.adminEmail,
+            adminPassword: state.adminPassword,
+            deployment,
+            observe: state.observe ?? false,
+            clickhouseUrl: state.clickhouseUrl,
+            geoip: state.geoip ?? false,
+            geoipStrategy: state.geoipStrategy,
+            maxmindAccountId: state.maxmindAccountId,
+            maxmindLicenseKey: state.maxmindLicenseKey,
+        };
+        let content;
+        let writtenLabel;
+        let validateTarget;
+        if (deployment === 'helm') {
+            const outDir = path_1.default.resolve(process.cwd(), HELM_OUT_DIR);
+            const valuesPath = path_1.default.join(outDir, 'values.yaml');
+            const secretsPath = path_1.default.join(outDir, helmValues_1.HELM_SECRETS_FILE);
+            if ((await fs_extra_1.default.pathExists(valuesPath)) || (await fs_extra_1.default.pathExists(secretsPath))) {
+                const overwrite = await (0, prompts_1.confirmStep)('xprem-helm/ already holds a generated pair. Overwrite it?');
+                if (!overwrite) {
+                    log_1.default.cancel('Aborted, nothing was written.');
+                    return;
+                }
+            }
+            await fs_extra_1.default.mkdirp(outDir);
+            // Before the write, so a failure between the two cannot leave a tracked
+            // secret behind. values.yaml carries no secret and stays committable.
+            (0, utils_1.ensureGitIgnored)(process.cwd(), `${HELM_OUT_DIR}/${helmValues_1.HELM_SECRETS_FILE}`, SECRET_FILE_REASON);
+            const valuesContent = (0, helmValues_1.renderHelmValues)(choices);
+            const secretsContent = (0, helmValues_1.renderHelmSecretsValues)(choices);
+            await fs_extra_1.default.writeFile(valuesPath, valuesContent);
+            await writeSecretFile(secretsPath, secretsContent);
+            content = valuesContent + secretsContent;
+            writtenLabel = `xprem-helm/values.yaml and xprem-helm/${helmValues_1.HELM_SECRETS_FILE}`;
+            validateTarget = 'xprem-helm';
+        }
+        else {
+            const fileName = ENV_FILE_NAME;
+            const filePath = path_1.default.resolve(process.cwd(), fileName);
+            if (await fs_extra_1.default.pathExists(filePath)) {
+                const overwrite = await (0, prompts_1.confirmStep)(`${fileName} already exists. Overwrite it?`);
+                if (!overwrite) {
+                    log_1.default.cancel('Aborted, nothing was written.');
+                    return;
+                }
+            }
+            (0, utils_1.ensureGitIgnored)(process.cwd(), ENV_FILE_NAME, SECRET_FILE_REASON);
+            content = (0, envCatalog_1.renderEnvFile)(choices);
+            await writeSecretFile(filePath, content);
+            writtenLabel = fileName;
+            validateTarget = fileName;
+        }
+        log_1.default.succeed(`Wrote ${chalk_1.default.bold(writtenLabel)}`);
+        const placeholders = new Set(content.match(/<[^>\n]+>/g) ?? []);
+        if (placeholders.size > 0) {
+            log_1.default.withInfo(`${placeholders.size} placeholder(s) left to fill: ${chalk_1.default.dim([...placeholders].join(', '))}`);
+        }
+        if (existingMasterKey.key) {
+            log_1.default.withInfo(`${MASTER_KEY_VAR} was carried over from the previous configuration.`);
+        }
+        else {
+            log_1.default.warn(`${MASTER_KEY_VAR} was generated in the file. Back it up now; it is not recoverable.`);
+        }
+        const nextSteps = [];
+        if (deployment === 'docker') {
+            nextSteps.push(`docker run --env-file ${writtenLabel} -p 3000:3000 ${DOCKER_IMAGE}`);
+        }
+        else if (deployment === 'binary') {
+            nextSteps.push(`Rename ${writtenLabel} to .env next to the binary: the server loads .env at startup.`);
+        }
+        else {
+            nextSteps.push(`helm install xprem ${HELM_CHART} \\`, `  -f xprem-helm/values.yaml -f xprem-helm/${helmValues_1.HELM_SECRETS_FILE} -n <namespace>`, `${HELM_OUT_DIR}/${helmValues_1.HELM_SECRETS_FILE} is gitignored and readable by you only; values.yaml is safe to commit.`, 'To change a secret later: edit it there and helm upgrade with the same flags.');
+        }
+        log_1.default.note(nextSteps.join('\n'), 'Next steps');
+        log_1.default.outro(`Check the configuration anytime: ${ACCENT(`npx eoas server:validate ${validateTarget}`)}`);
+    }
+}
+exports.default = ServerInit;

package/dist/commands/server/validate.d.ts

@@ -0,0 +1,10 @@
+import { Command } from '@oclif/core';
+export default class ServerValidate extends Command {
+    static args: {
+        file: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {};
+    run(): Promise<void>;
+}