landfall 0.1.0 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +260 -163
- package/dist/cli.mjs +333 -189
- package/dist/index.html +305 -91
- package/dist/{job-CypEf1ud.mjs → job-DOi_DnYQ.mjs} +1 -1
- package/dist/server-Cj4TXzYj.mjs +4 -0
- package/dist/tui-0-Gcinq3.mjs +8 -0
- package/package.json +4 -3
- package/dist/server-CkG3c5Za.mjs +0 -4
- package/dist/tui-B0KECXvO.mjs +0 -8
package/dist/cli.mjs
CHANGED
|
@@ -1,18 +1,10 @@
|
|
|
1
1
|
#!/usr/bin/env node
|
|
2
|
-
import{parseArgs as e}from"node:util";import{execFileSync as t,spawn as n,spawnSync as r}from"node:child_process";import{createInterface as i}from"node:readline/promises";import a from"string-width";import o from"node:fs";import{homedir as s,hostname as c,tmpdir as l,userInfo as u}from"node:os";import{basename as d,dirname as f,join as p,relative as m,resolve as
|
|
3
|
-
`)return t.off(`data`,i),e(n);if(o===``)return t.off(`data`,i),r(new
|
|
4
|
-
`)}}function ae(e){let t=process.platform===`darwin`?`open`:process.platform===`win32`?`explorer`:`xdg-open`;n(t,[e],{stdio:`ignore`,detached:!0}).on(`error`,()=>{}).unref()}const
|
|
5
|
-
`)}function le(e,t,n){let r=e=>e.replace(/^([A-Za-z_][A-Za-z0-9_]*)=.*/s,`$1=…`),i=Object.entries(n).flatMap(([t,n])=>t===`server`||t===`yes`||t===`help`||n===void 0||n===e.options?.[t]?.default?[]:n===!1?[`--no-${t}`]:n===!0?[`--${t}`]:(Array.isArray(n)?n:[n]).map(e=>/pass|secret|token/i.test(t)?`--${t} …`:`--${t} ${r(String(e))}`));return[e.name,...t.map(r),...i].join(` `)}const ue=
|
|
6
|
-
|
|
7
|
-
`)
|
|
8
|
-
`),a=await Ie(`ssh`,[...Pe(e),n.sudo?`sudo -n bash -s`:`bash -s`],{input:`set -euo pipefail\n${i}\n${t}\n`,capture:n.capture});if(a.code!==0){let t=a.stderr.trim().split(`
|
|
9
|
-
`).at(-1);D(`remote command failed on ${e.host} (exit ${a.code})${t?`: ${t}`:``}`)}return a}async function H(e){let{code:t}=await Ie(`ssh`,[...Pe(e,{batch:!0,noMux:!0}),`true`],{capture:!0});return t===0}const ze=[`.git`,`node_modules`,`.DS_Store`,`srv.json`,`.env`,`.env.*`];let Be;async function Ve(){if(!Be){let{stdout:e}=await Ie(`tar`,[`--version`],{capture:!0});Be=e.includes(`bsdtar`)?[`--no-xattrs`,`--no-mac-metadata`,`--no-acls`]:[]}return Be}async function He(e,t,r,i=ze){o.existsSync(t)||D(`directory not found: ${t}`);let a=[...await Ve(),`-czf`,`-`,...i.flatMap(e=>[`--exclude`,e]),`-C`,t,`.`],s=`mkdir -p ${B(r)} && tar -xzof - -C ${B(r)}`;await new Promise((t,r)=>{let i=n(`tar`,a,{stdio:[`ignore`,`pipe`,`inherit`],env:{...process.env,COPYFILE_DISABLE:`1`}}),o=n(`ssh`,[...Pe(e),s],{stdio:[`pipe`,`inherit`,`inherit`]});i.stdout.pipe(o.stdin),i.on(`error`,r),o.on(`error`,r);let c=e=>new Promise(t=>e.on(`close`,e=>t(e??1)));Promise.all([c(i),c(o)]).then(([e,n])=>{e===0?n===0?t():r(/* @__PURE__ */ Error(`upload failed (exit ${n})`)):r(/* @__PURE__ */ Error(`tar failed (exit ${e})`))})})}const U=(e,t,n=`644`)=>`printf %s ${B(Buffer.from(t).toString(`base64`))} | base64 -d > ${B(e)} && chmod ${n} ${B(e)}`,Ue=process.env.SRV_SSH_CONFIG??p(s(),`.ssh`,`config`),We=/* @__PURE__ */ new Map;function W(e){let n=[...je(e),`-G`,Ae(e)],r=We.get(n.join(`\0`));if(r)return r;let i;try{i=t(`ssh`,n,{encoding:`utf8`,stdio:[`ignore`,`pipe`,`pipe`]})}catch(t){return D(`ssh cannot resolve ${Ae(e)}: ${String(t.stderr??t.message).trim()}`)}let a=e=>i.match(RegExp(`^${e} (.+)$`,`m`))?.[1]??``,o=[...i.matchAll(/^identityfile (.+)$/gm)].map(e=>I(e[1])),s={hostname:a(`hostname`),user:a(`user`),port:Number(a(`port`)||22),identityFiles:o};return We.set(n.join(`\0`),s),s}function Ge(e){return(e.key?[I(e.key)]:W(e).identityFiles).find(e=>o.existsSync(e)&&o.existsSync(`${e}.pub`))}function Ke(e=Ue,t=/* @__PURE__ */ new Set){if(t.has(e)||!o.existsSync(e))return[];t.add(e);let n=[];for(let r of o.readFileSync(e,`utf8`).split(`
|
|
10
|
-
`)){let e=r.trim().match(/^(\w+)\s*=?\s*(.+)$/);if(!e)continue;let[,i,a]=e;if(i.toLowerCase()===`host`)n.push(...a.split(/\s+/).filter(e=>!/[*?!]/.test(e)));else if(i.toLowerCase()===`include`)for(let e of a.split(/\s+/)){let r=I(e),i=r.startsWith(`/`)?r:p(s(),`.ssh`,r);for(let e of qe(i))n.push(...Ke(e,t))}}return[...new Set(n)]}function qe(e){if(!/[*?[]/.test(e))return[e];let t=f(e);return o.existsSync(t)?o.globSync(d(e),{cwd:t}).map(e=>p(t,e)):[]}const Je=e=>[`# >>> srv:${e}`,`# <<< srv:${e}`];function Ye(e){let[t,n]=Je(e.alias);return[t,`Host ${e.alias}`,` HostName ${e.hostname}`,` User ${e.user}`,...e.port===22?[]:[` Port ${e.port}`],` IdentityFile ${e.key}`,` IdentitiesOnly yes`,n].join(`
|
|
11
|
-
`)}function Xe(e,t=Ue){let[n,r]=Je(e.alias),i=!o.existsSync(t),a=i?``:o.readFileSync(t,`utf8`),s=Ye(e),c=RegExp(`${tt(n)}[\\s\\S]*?${tt(r)}\\n?`),l=c.test(a)?a.replace(c,s+`
|
|
12
|
-
`):`${s}\n\n${a}`;return o.mkdirSync(p(t,`..`),{recursive:!0,mode:448}),o.writeFileSync(t,l,{mode:384}),We.clear(),{created:i,block:s}}function Ze(e,t=Ue,n=/* @__PURE__ */ new Set){if(n.has(t)||!o.existsSync(t))return;n.add(t);let r=o.readFileSync(t,`utf8`).split(`
|
|
13
|
-
`);for(let i=0;i<r.length;i++){let a=r[i].trim().match(/^(\w+)\s*=?\s*(.+)$/);if(!a)continue;let o=a[1].toLowerCase();if(o===`host`&&a[2].split(/\s+/).includes(e)){let n=i+1;for(;n<r.length&&!/^\s*(host|match)\b/i.test(r[n])&&!r[n].startsWith(`# <<< srv:`);)n++;for(;n>i+1&&/^\s*(#.*)?$/.test(r[n-1]);)n--;return{file:t,start:i,end:n,lines:r.slice(i,n),managed:r[i-1]===Je(e)[0]}}if(o===`include`)for(let t of a[2].split(/\s+/)){let r=I(t);for(let t of qe(r.startsWith(`/`)?r:p(s(),`.ssh`,r))){let r=Ze(e,t,n);if(r)return r}}}}function Qe(e,t){let n=Ze(e);if(!n)return;let r=o.readFileSync(n.file,`utf8`).split(`
|
|
14
|
-
`),i=r.slice(n.start+1,n.end),a=e=>e.trim().match(/^identityfile\s*=?\s*(.+)$/i)?.[1].replace(/^"(.*)"$/,`$1`),s=i.filter(e=>{let n=a(e);return n!==void 0&&(!o.existsSync(I(n))||I(n)===t)}),c=`${i.find(e=>e.trim())?.match(/^\s*/)?.[0]||` `}IdentityFile ${t}`,l=i.filter(e=>!s.includes(e));r.splice(n.start+1,i.length,c,...l);let u=`${n.file}.srv-bak`;return o.existsSync(u)||o.copyFileSync(n.file,u),o.writeFileSync(n.file,r.join(`
|
|
15
|
-
`)),We.clear(),{file:n.file,removed:s.map(e=>e.trim()),added:c.trim(),backup:u}}function $e(e,t=Ue){if(!o.existsSync(t))return!1;let[n,r]=Je(e),i=o.readFileSync(t,`utf8`),a=RegExp(`${tt(n)}[\\s\\S]*?${tt(r)}\\n*`);return a.test(i)?(o.writeFileSync(t,i.replace(a,``)),!0):!1}const et=(e,t=Ue)=>o.existsSync(t)&&o.readFileSync(t,`utf8`).includes(Je(e)[0]),tt=e=>e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`),G=`/opt/srv`,K=`${G}/sites`,q=`${G}/traefik`,nt=`traefik:v3`,J=`${G}/proxy.env`,Y=`${G}/journal.log`,rt={container:`traefik`,network:`web`,entrypoint:`websecure`,resolver:`le`},it=`"$(sed -n 's/^container=//p' ${J} 2>/dev/null | grep . || echo traefik)"`;function at(e){let{container:t,network:n,entrypoint:r,resolver:i}=Object.fromEntries(e.split(/\s+/).filter(e=>e.includes(`=`)&&!e.startsWith(`#`)).map(e=>[e.slice(0,e.indexOf(`=`)),e.slice(e.indexOf(`=`)+1)]));return t&&n&&r&&i?{container:t,network:n,entrypoint:r,resolver:i}:void 0}const ot=e=>`# srv routes its sites through this existing traefik; delete the file to let srv run its own\ncontainer=${e.container}\nnetwork=${e.network}\nentrypoint=${e.entrypoint}\nresolver=${e.resolver}\n`,X=String.raw`
|
|
2
|
+
import{parseArgs as e}from"node:util";import{execFileSync as t,spawn as n,spawnSync as r}from"node:child_process";import{createInterface as i}from"node:readline/promises";import a from"string-width";import o from"node:fs";import{homedir as s,hostname as c,tmpdir as l,userInfo as u}from"node:os";import{basename as d,dirname as f,join as p,relative as m,resolve as h}from"node:path";import{promises as ee}from"node:dns";import{isIP as g}from"node:net";import{parse as _}from"yaml";import{randomBytes as v}from"node:crypto";import y from"bcryptjs";const b=process.stdout.isTTY&&!process.env.NO_COLOR,x=e=>t=>b?`\x1b[${e}m${t}\x1b[0m`:t,S={bold:x(`1`),dim:x(`2`),red:x(`31`),green:x(`32`),yellow:x(`33`),blue:x(`34`),cyan:x(`36`)},C=e=>console.error(`${S.cyan(`==>`)} ${S.bold(e)}`),w=e=>console.error(`${S.green(`✓`)} ${e}`),T=e=>console.error(` ${e}`),E=e=>console.error(`${S.yellow(`!`)} ${e}`);var D=class extends Error{};const O=e=>{throw new D(e)};let k=!1;const A=e=>k=e,te=()=>!k&&!!process.stdin.isTTY;async function ne(e,t){if(k||!process.stdin.isTTY){if(t!==void 0)return t;O(`missing value for "${e}" (no TTY; pass it as a flag)`)}let n=i({input:process.stdin,output:process.stderr});try{return(await n.question(`${S.blue(`?`)} ${e}${t?S.dim(` (${t})`):``} `)).trim()||t||``}finally{n.close()}}async function re(e){return k||!process.stdin.isTTY?!1:M(e,!1)}async function j(e,t){k||(process.stdin.isTTY||O(`${e} Pass -y to confirm (no terminal to ask).`),t?await ne(`${e} Type ${S.bold(t)} to confirm:`)!==t&&O(`cancelled`):await M(e,!1)||O(`cancelled`))}async function M(e,t=!0){return k?!0:process.stdin.isTTY?(await ne(`${e} ${t?`[Y/n]`:`[y/N]`}`,t?`y`:`n`)).toLowerCase().startsWith(`y`):t}function N(e){if(!e.length)return;let t=e[0].map((t,n)=>Math.max(...e.map(e=>a(e[n]??``))));for(let n of e)console.log(n.map((e,n)=>e+` `.repeat(t[n]-a(e))).join(` `).trimEnd())}const P=e=>{let t=(Date.now()-Date.parse(e))/1e3;return t<90?`${Math.round(t)}s ago`:t<5400?`${Math.round(t/60)}m ago`:t<129600?`${Math.round(t/3600)}h ago`:`${Math.round(t/86400)}d ago`};async function ie(e){(k||!process.stdin.isTTY)&&O(`missing value for "${e}" (no TTY; pass it as a flag)`),process.stderr.write(`${S.blue(`?`)} ${e} `);let t=process.stdin;t.setRawMode(!0),t.resume();let n=``;try{return await new Promise((e,r)=>{let i=a=>{for(let o of a.toString(`utf8`)){if(o===`\r`||o===`
|
|
3
|
+
`)return t.off(`data`,i),e(n);if(o===``)return t.off(`data`,i),r(new D(`cancelled`));o===``||o===`\b`?n=n.slice(0,-1):n+=o}};t.on(`data`,i)})}finally{t.setRawMode(!1),t.pause(),process.stderr.write(`
|
|
4
|
+
`)}}function ae(e){let t=process.platform===`darwin`?`open`:process.platform===`win32`?`explorer`:`xdg-open`;n(t,[e],{stdio:`ignore`,detached:!0}).on(`error`,()=>{}).unref()}const F=e=>e,I={type:`string`,short:`s`,desc:`server name or ssh alias`},oe={help:{type:`boolean`,short:`h`,desc:`show this help`},yes:{type:`boolean`,short:`y`,desc:`assume yes / defaults for prompts`}};function se(t,n){let r=n.indexOf(`--`),i=t.passthrough&&r>=0?n.slice(0,r):n,a=t.passthrough&&r>=0?n.slice(r+1):[],o={};for(let[e,{desc:n,...r}]of Object.entries({...oe,...t.options}))o[e]=r;try{let{values:t,positionals:n}=e({args:i,options:o,allowPositionals:!0,allowNegative:!0});return{values:t,positionals:n,rest:a}}catch(e){return O(`${e.message}\n\n${ce(t)}`)}}function ce(e){let t=[`${S.bold(`Usage:`)} lf ${e.name}${e.args?` `+e.args:``} [options]`,``,e.summary];t.push(``,S.bold(`Options:`));let n=Object.entries({...e.options,yes:oe.yes}).map(([e,t])=>{let n=`${t.short?`-${t.short}, `:` `}--${e}${t.type===`string`?` <${e}>`:``}`,r=t.default!==void 0&&t.default!==!1?S.dim(` (default: ${t.default})`):``;return[n,t.desc+(t.multiple?S.dim(` (repeatable)`):``)+r]}),r=Math.max(...n.map(e=>e[0].length));for(let[e,i]of n)t.push(` ${e.padEnd(r)} ${i}`);return t.join(`
|
|
5
|
+
`)}function le(e,t,n){let r=e=>e.replace(/^([A-Za-z_][A-Za-z0-9_]*)=.*/s,`$1=…`),i=Object.entries(n).flatMap(([t,n])=>t===`server`||t===`yes`||t===`help`||n===void 0||n===e.options?.[t]?.default?[]:n===!1?[`--no-${t}`]:n===!0?[`--${t}`]:(Array.isArray(n)?n:[n]).map(e=>/pass|secret|token/i.test(t)?`--${t} …`:`--${t} ${r(String(e))}`));return[e.name,...t.map(r),...i].join(` `)}let ue=!1;const de=e=>ue=e,L=e=>`'${String(e).replace(/'/g,`'\\''`)}'`,fe=(e=Xe(`SSH_CONFIG`))=>e?[`-F`,o.existsSync(e)?e:`/dev/null`]:[],pe=e=>e.user?`${e.user}@${e.host}`:e.host;function me(e){let t=[...fe(),`-o`,`StrictHostKeyChecking=accept-new`];return e.port&&t.push(`-p`,String(e.port)),e.key&&t.push(`-i`,q(e.key),`-o`,`IdentitiesOnly=yes`),t}let he;function ge(){return he||(he=p(process.platform===`darwin`?`/tmp`:l(),`landfall-${u().uid}`),o.mkdirSync(he,{recursive:!0,mode:448})),he}function _e(e,t={}){let n=[...me(e),`-o`,`ServerAliveInterval=15`];return(t.batch||ue)&&n.push(`-o`,`BatchMode=yes`,`-o`,`ConnectTimeout=10`),t.noMux?n.push(`-o`,`ControlPath=none`):n.push(`-o`,`ControlMaster=auto`,`-o`,`ControlPath=${ge()}/%C`,`-o`,`ControlPersist=60`),n.push(t.tty?`-t`:`-T`,pe(e)),n}function ve(e){return new Promise(t=>{let r=[...me(e),`-o`,`ControlPath=${ge()}/%C`,`-O`,`exit`,pe(e)];n(`ssh`,r,{stdio:`ignore`}).on(`close`,()=>t()).on(`error`,()=>t())})}function ye(e,t,r){return new Promise((i,a)=>{let o=n(e,t,{...r,stdio:[r.input===void 0?`inherit`:`pipe`,r.capture?`pipe`:`inherit`,ue?`pipe`:`inherit`]}),s=``,c=``;o.stdout?.on(`data`,e=>s+=e),o.stderr?.on(`data`,e=>c+=e),o.on(`error`,a),o.on(`close`,e=>i({code:e??1,stdout:s,stderr:c})),r.input!==void 0&&o.stdin.end(r.input)})}async function be(e,t=[]){let{code:n}=await ye(`ssh`,[..._e(e,{tty:process.stdin.isTTY}),...t],{});return n}const xe={run:process.env.LANDFALL_RUN||`${Date.now().toString(36)}${Math.random().toString(36).slice(2,6)}`,actor:`${u().username}@${c().split(`.`)[0]}`,cmd:``};async function R(e,t,n={}){let r={LANDFALL_RUN:xe.run,LANDFALL_ACTOR:xe.actor,LANDFALL_CMD:xe.cmd,...n.env},i=Object.entries(r).filter(([,e])=>e!==void 0).map(([e,t])=>`${e}=${L(typeof t==`boolean`?+!!t:t)}`).join(`
|
|
6
|
+
`),a=await ye(`ssh`,[..._e(e),n.sudo?`sudo -n bash -s`:`bash -s`],{input:`set -euo pipefail\n${i}\n${n.oldLayout?``:Ke}${t}\n`,capture:n.capture});if(a.code!==0){let t=a.stderr.trim().split(`
|
|
7
|
+
`).at(-1);O(`remote command failed on ${e.host} (exit ${a.code})${t?`: ${t}`:``}`)}return a}async function Se(e){let{code:t}=await ye(`ssh`,[..._e(e,{batch:!0,noMux:!0}),`true`],{capture:!0});return t===0}const Ce=()=>[`.git`,`node_modules`,`.DS_Store`,`.landfall.json`,We,`.env`,`.env.*`,`compose.override.*`,`docker-compose.override.*`];let we;async function Te(){if(!we){let{stdout:e}=await ye(`tar`,[`--version`],{capture:!0});we=e.includes(`bsdtar`)?[`--no-xattrs`,`--no-mac-metadata`,`--no-acls`]:[]}return we}async function Ee(e,t,r,i=Ce()){o.existsSync(t)||O(`directory not found: ${t}`);let a=[...await Te(),`-czf`,`-`,...i.flatMap(e=>[`--exclude`,e]),`-C`,t,`.`],s=`mkdir -p ${L(r)} && tar -xzof - -C ${L(r)}`;await new Promise((t,r)=>{let i=n(`tar`,a,{stdio:[`ignore`,`pipe`,`inherit`],env:{...process.env,COPYFILE_DISABLE:`1`}}),o=n(`ssh`,[..._e(e),s],{stdio:[`pipe`,`inherit`,`inherit`]});i.stdout.pipe(o.stdin),i.on(`error`,r),o.on(`error`,r);let c=e=>new Promise(t=>e.on(`close`,e=>t(e??1)));Promise.all([c(i),c(o)]).then(([e,n])=>{e===0?n===0?t():r(/* @__PURE__ */ Error(`upload failed (exit ${n})`)):r(/* @__PURE__ */ Error(`tar failed (exit ${e})`))})})}const z=(e,t,n=`644`)=>`printf %s ${L(Buffer.from(t).toString(`base64`))} | base64 -d > ${L(e)} && chmod ${n} ${L(e)}`,B=`/opt/landfall`,V=`${B}/sites`,H=`${B}/traefik`,De=`${H}/dynamic`,Oe=`traefik:v3`,U=`${B}/proxy.env`,W=`${B}/journal.log`,ke=`/etc/ssh/sshd_config.d/00-landfall.conf`,Ae={container:`traefik`,network:`web`,entrypoint:`websecure`,resolver:`le`},je=`"$(sed -n 's/^container=//p' ${U} 2>/dev/null | grep . || echo traefik)"`;function Me(e){let{container:t,network:n,entrypoint:r,resolver:i}=Object.fromEntries(e.split(/\s+/).filter(e=>e.includes(`=`)&&!e.startsWith(`#`)).map(e=>[e.slice(0,e.indexOf(`=`)),e.slice(e.indexOf(`=`)+1)]));return t&&n&&r&&i?{container:t,network:n,entrypoint:r,resolver:i}:void 0}const Ne=e=>`# landfall routes its sites through this existing traefik; delete the file to let landfall run its own\ncontainer=${e.container}\nnetwork=${e.network}\nentrypoint=${e.entrypoint}\nresolver=${e.resolver}\n`,G=String.raw`
|
|
16
8
|
log() { printf '\033[36m ->\033[0m %s\n' "$*" >&2; }
|
|
17
9
|
SUDO=""; if [ "$(id -u)" -ne 0 ]; then SUDO="sudo"; fi
|
|
18
10
|
# The distro's package manager, and installing with it.
|
|
@@ -63,34 +55,34 @@ ensure_running() {
|
|
|
63
55
|
}
|
|
64
56
|
sshd_reload() { $SUDO systemctl reload ssh 2>/dev/null || $SUDO systemctl reload sshd 2>/dev/null || $SUDO service ssh reload 2>/dev/null || true; }
|
|
65
57
|
|
|
66
|
-
# Journal.
|
|
58
|
+
# Journal. LANDFALL_RUN/LANDFALL_ACTOR/LANDFALL_CMD come from runScript. Writing it never fails a script.
|
|
67
59
|
_clean() { printf %s "$1" | tr '\t\n' ' '; }
|
|
68
60
|
_journal() { # _journal <do|undo> <what> <undo shell>
|
|
69
|
-
line=$(printf '%s\t' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$
|
|
61
|
+
line=$(printf '%s\t' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$LANDFALL_RUN" "$(_clean "$LANDFALL_ACTOR")" "$(id -un)" "$(_clean "$LANDFALL_CMD")" "$1" "$(_clean "$2")")
|
|
70
62
|
line="$line$(printf %s "$3" | base64 | tr -d '\n')"
|
|
71
|
-
if [ -w ${
|
|
72
|
-
printf '%s\n' "$line" >> ${
|
|
63
|
+
if [ -w ${W} ] || { [ ! -e ${W} ] && [ -w ${B} ]; }; then
|
|
64
|
+
printf '%s\n' "$line" >> ${W}
|
|
73
65
|
elif [ -n "$SUDO" ] && ! sudo -n true 2>/dev/null; then false
|
|
74
66
|
else
|
|
75
|
-
{ $SUDO install -d ${
|
|
76
|
-
fi || { log "warning: could not write ${
|
|
67
|
+
{ $SUDO install -d ${B} && printf '%s\n' "$line" | $SUDO tee -a ${W} >/dev/null; } 2>/dev/null
|
|
68
|
+
fi || { log "warning: could not write ${W}"; return 0; }
|
|
77
69
|
# A root (or sudo) first entry would leave the file root-owned, and deploy users could no longer
|
|
78
|
-
# append; it belongs to whoever owns ${
|
|
79
|
-
[ -O ${
|
|
70
|
+
# append; it belongs to whoever owns ${B}.
|
|
71
|
+
[ -O ${W} ] && [ "$(id -u)" -ne 0 ] || $([ -z "$SUDO" ] || echo sudo -n) chown "$(stat -c %u:%g ${B})" ${W} 2>/dev/null || true
|
|
80
72
|
}
|
|
81
73
|
# record <what> [undo shell]: journal a change; no undo shell = not reversible.
|
|
82
74
|
record() { _journal do "$1" "$(shift; printf %s "$*")"; }
|
|
83
|
-
# Run as $SUDO only when <dir> is not writable: deploy users own ${
|
|
75
|
+
# Run as $SUDO only when <dir> is not writable: deploy users own ${B} and need no sudo.
|
|
84
76
|
_as() { if [ -w "$1" ]; then shift; "$@"; else shift; $SUDO "$@"; fi; }
|
|
85
77
|
# saved <file>: back the file up, print the shell that puts it back (or removes it if it was new).
|
|
86
78
|
saved() {
|
|
87
|
-
d=$(dirname "$1"); b="$d/.$(basename "$1").
|
|
79
|
+
d=$(dirname "$1"); b="$d/.$(basename "$1").landfall-$LANDFALL_RUN-$RANDOM"
|
|
88
80
|
# $(saved ...) does not inherit set -e: fail explicitly so callers stop instead of journaling a missing backup.
|
|
89
81
|
if _as "$d" test -e "$1"; then _as "$d" cp -p "$1" "$b" || return 1; printf 'restore_file %q %q' "$b" "$1"
|
|
90
82
|
else printf '_as %q rm -f %q' "$d" "$1"; fi
|
|
91
83
|
# Keep the newest ${10} backups per file: old ones pile up (and .env copies hold secrets).
|
|
92
84
|
# By ctime: cp -p keeps the original's mtime, so mtime says nothing about when the backup was made.
|
|
93
|
-
_as "$d" ls -1Atc "$d" 2>/dev/null | awk -v p=".$(basename "$1").
|
|
85
|
+
_as "$d" ls -1Atc "$d" 2>/dev/null | awk -v p=".$(basename "$1").landfall-" 'index($0, p) == 1' | tail -n +$((${10} + 1)) \
|
|
94
86
|
| while IFS= read -r f; do _as "$d" rm -f "$d/$f"; done || true
|
|
95
87
|
}
|
|
96
88
|
restore_file() { # restore_file <backup> <file>
|
|
@@ -120,19 +112,38 @@ ufw_enable() {
|
|
|
120
112
|
*inactive*) $SUDO ufw --force enable >/dev/null; record "enabled ufw" '$SUDO ufw disable >/dev/null' ;;
|
|
121
113
|
esac
|
|
122
114
|
}
|
|
123
|
-
`,
|
|
115
|
+
`,Pe=`/usr/local/lib/docker/cli-plugins/docker-compose`,Fe=String.raw`
|
|
124
116
|
compose_install() {
|
|
125
117
|
arch=$(uname -m); case "$arch" in armv7l) arch=armv7 ;; armv6l) arch=armv6 ;; esac
|
|
126
|
-
f=${
|
|
118
|
+
f=${Pe}
|
|
127
119
|
$SUDO mkdir -p "$(dirname $f)" || return 1
|
|
128
120
|
$SUDO curl -fsSL -o $f.new "https://github.com/docker/compose/releases/latest/download/docker-compose-linux-$arch" || { $SUDO rm -f $f.new; return 1; }
|
|
129
121
|
$SUDO chmod 755 $f.new
|
|
130
|
-
if [ -f $f ]; then $SUDO mv $f $f.
|
|
122
|
+
if [ -f $f ]; then $SUDO mv $f $f.landfall-$LANDFALL_RUN; undo="\$SUDO mv $f.landfall-$LANDFALL_RUN $f"; else undo="\$SUDO rm -f $f"; fi
|
|
131
123
|
$SUDO mv $f.new $f
|
|
132
124
|
record "installed docker compose $(docker compose version --short 2>/dev/null) to $f" "$undo"
|
|
133
125
|
}
|
|
134
|
-
`,
|
|
135
|
-
|
|
126
|
+
`,Ie=`This server is run by landfall (https://www.npmjs.com/package/landfall).
|
|
127
|
+
Everything here works without it: it is plain Docker Compose.
|
|
128
|
+
|
|
129
|
+
${H}/ Traefik: docker-compose.yml, letsencrypt/ (certificates), dynamic/ (file provider)
|
|
130
|
+
${V}/<site>/ one Compose project per site
|
|
131
|
+
.env the site's environment (lf env), mode 600
|
|
132
|
+
site.json landfall's notes: domains, releases
|
|
133
|
+
current -> releases/<id> the live release
|
|
134
|
+
releases/<id>/compose.yaml the site's compose file as deployed
|
|
135
|
+
releases/<id>/compose.override.yaml landfall's: Traefik labels, proxy network, project name
|
|
136
|
+
${W} every change landfall made, with the shell that undoes it
|
|
137
|
+
|
|
138
|
+
Run a site by hand:
|
|
139
|
+
cd ${V}/<site>/current && docker compose ps (logs, restart, up -d, down …)
|
|
140
|
+
Roll back by hand:
|
|
141
|
+
cd ${V}/<site> && ln -sfn releases/<id> current && cd -P current && docker compose up -d
|
|
142
|
+
|
|
143
|
+
Named volumes (databases, uploads) belong to the project, not the release: they survive
|
|
144
|
+
deploys and rollbacks. "lf sites rm" keeps them; "lf sites rm --volumes" deletes them.
|
|
145
|
+
`,Le=String.raw`
|
|
146
|
+
${Fe}
|
|
136
147
|
if [ -n "$SUDO" ] && ! sudo -n true 2>/dev/null; then
|
|
137
148
|
echo "setup needs root or passwordless sudo for $(id -un) (try: lf setup <name> --user root)" >&2
|
|
138
149
|
exit 1
|
|
@@ -159,10 +170,10 @@ if ! command -v docker >/dev/null 2>&1; then
|
|
|
159
170
|
record "installed docker"
|
|
160
171
|
fi
|
|
161
172
|
$SUDO systemctl enable --now docker >/dev/null 2>&1 || $SUDO service docker start >/dev/null 2>&1 || true
|
|
162
|
-
#
|
|
163
|
-
# Docker's own repo has the newest plugin, everyone else gets the
|
|
173
|
+
# Sites need compose 2.24+ (optional env_file, up --wait). Distro docker packages (docker.io, moby)
|
|
174
|
+
# often lack it or ship older: Docker's own repo has the newest plugin, everyone else gets the release binary.
|
|
164
175
|
v=$(docker compose version --short 2>/dev/null | sed 's/^v//' || true)
|
|
165
|
-
case "$v" in ""|0.*|1.*)
|
|
176
|
+
case "$v" in ""|0.*|1.*|2.[0-9].*|2.1[0-9].*|2.2[0-3].*)
|
|
166
177
|
log "installing the newest docker compose"
|
|
167
178
|
if pkg_has docker-ce && pkg_install docker-compose-plugin; then record "installed docker-compose-plugin"
|
|
168
179
|
else compose_install || log "could not install docker compose; install it, then re-run setup"; fi ;;
|
|
@@ -174,7 +185,7 @@ if [ -n "$DEPLOY_USER" ]; then
|
|
|
174
185
|
$SUDO useradd -m -s /bin/bash "$DEPLOY_USER"
|
|
175
186
|
# '*' = no password but not locked; sshd without PAM refuses locked accounts even for keys.
|
|
176
187
|
$SUDO usermod -p '*' "$DEPLOY_USER"
|
|
177
|
-
# userdel refuses while the user has processes (a lingering ssh session of
|
|
188
|
+
# userdel refuses while the user has processes (a lingering ssh session of landfall's own).
|
|
178
189
|
record "created user $DEPLOY_USER" "[ \"\$(id -un)\" = $DEPLOY_USER ] || \$SUDO pkill -u $DEPLOY_USER 2>/dev/null || true; for i in 1 2 3 4 5; do \$SUDO userdel -r $DEPLOY_USER 2>/dev/null && break; ! id $DEPLOY_USER >/dev/null 2>&1 && break; sleep 1; done; ! id $DEPLOY_USER >/dev/null 2>&1 || \$SUDO deluser --remove-home $DEPLOY_USER"
|
|
179
190
|
fi
|
|
180
191
|
case " $(id -nG "$DEPLOY_USER") " in
|
|
@@ -187,7 +198,7 @@ if [ -n "$DEPLOY_USER" ]; then
|
|
|
187
198
|
$SUDO touch "$home/.ssh/authorized_keys"
|
|
188
199
|
if ! $SUDO grep -qxF "$PUBKEY" "$home/.ssh/authorized_keys"; then
|
|
189
200
|
printf '%s\n' "$PUBKEY" | $SUDO tee -a "$home/.ssh/authorized_keys" >/dev/null
|
|
190
|
-
record "authorized
|
|
201
|
+
record "authorized landfall's key for $DEPLOY_USER" "drop_line $(printf %q "$home/.ssh/authorized_keys") $(printf %q "$PUBKEY")"
|
|
191
202
|
fi
|
|
192
203
|
$SUDO chown "$DEPLOY_USER:$DEPLOY_USER" "$home/.ssh/authorized_keys"
|
|
193
204
|
$SUDO chmod 600 "$home/.ssh/authorized_keys"
|
|
@@ -196,14 +207,16 @@ else
|
|
|
196
207
|
OWNER="$(id -un)"
|
|
197
208
|
fi
|
|
198
209
|
|
|
199
|
-
log "preparing ${
|
|
200
|
-
new_sites=$([ -d ${
|
|
201
|
-
new_traefik=$([ -d ${
|
|
202
|
-
$SUDO install -d -o "$OWNER" -g "$OWNER" ${
|
|
203
|
-
$SUDO chown "$OWNER:$OWNER" ${
|
|
204
|
-
|
|
205
|
-
|
|
206
|
-
|
|
210
|
+
log "preparing ${B}"
|
|
211
|
+
new_sites=$([ -d ${V} ] || echo 1)
|
|
212
|
+
new_traefik=$([ -d ${H} ] || echo 1)
|
|
213
|
+
$SUDO install -d -o "$OWNER" -g "$OWNER" ${B} ${V} ${H}
|
|
214
|
+
$SUDO chown "$OWNER:$OWNER" ${W} 2>/dev/null || true
|
|
215
|
+
$SUDO tee ${B}/README >/dev/null <<'LANDFALL_README'
|
|
216
|
+
${Ie}LANDFALL_README
|
|
217
|
+
# ${B} itself stays: it holds the journal. Each dir is only removed if setup created it.
|
|
218
|
+
[ -z "$new_sites" ] || record "created ${V}" "_as ${B} rmdir ${V}"
|
|
219
|
+
[ -z "$new_traefik" ] || record "created ${H}" "_as ${B} rm -rf ${H}"
|
|
207
220
|
|
|
208
221
|
DOCKER="$SUDO docker" ensure_network ${`web`}
|
|
209
222
|
|
|
@@ -222,10 +235,10 @@ if [ "$HARDEN" = 1 ] && [ -d /etc/ssh ]; then
|
|
|
222
235
|
if [ "$($SUDO sshd -T 2>/dev/null | awk '$1 == "permitrootlogin" {print $2}')" = no ]; then root_login=no; fi
|
|
223
236
|
# 00- so it wins over cloud-init's 50-cloud-init.conf: sshd keeps the first value it reads.
|
|
224
237
|
want=$(printf '%s\n' 'PasswordAuthentication no' 'KbdInteractiveAuthentication no' "PermitRootLogin $root_login")
|
|
225
|
-
if [ "$($SUDO cat
|
|
238
|
+
if [ "$($SUDO cat ${ke} 2>/dev/null || true)" != "$want" ]; then
|
|
226
239
|
$SUDO install -d /etc/ssh/sshd_config.d
|
|
227
|
-
undo=$(saved
|
|
228
|
-
printf '%s\n' "$want" | $SUDO tee
|
|
240
|
+
undo=$(saved ${ke})
|
|
241
|
+
printf '%s\n' "$want" | $SUDO tee ${ke} >/dev/null
|
|
229
242
|
if ! grep -qE '^\s*Include\s+/etc/ssh/sshd_config.d' /etc/ssh/sshd_config; then
|
|
230
243
|
undo="$undo; $(saved /etc/ssh/sshd_config)"
|
|
231
244
|
printf 'Include /etc/ssh/sshd_config.d/*.conf\n%s' "$($SUDO cat /etc/ssh/sshd_config)" | $SUDO tee /etc/ssh/sshd_config >/dev/null
|
|
@@ -240,7 +253,7 @@ if [ "$HARDEN" = 1 ] && [ -d /etc/ssh ]; then
|
|
|
240
253
|
fi
|
|
241
254
|
fi
|
|
242
255
|
log "bootstrap done"
|
|
243
|
-
`,
|
|
256
|
+
`,Re=String.raw`
|
|
244
257
|
set +e
|
|
245
258
|
S() { if [ -n "$SUDO" ]; then sudo -n "$@"; else "$@"; fi; }
|
|
246
259
|
kv() { printf '%s=%s
|
|
@@ -269,17 +282,17 @@ if [ -n "$DEPLOY_USER" ] && id "$DEPLOY_USER" >/dev/null 2>&1; then
|
|
|
269
282
|
else
|
|
270
283
|
kv user 0
|
|
271
284
|
fi
|
|
272
|
-
kv root_dir "$(yn test -d ${
|
|
273
|
-
kv sites "$(ls ${
|
|
285
|
+
kv root_dir "$(yn test -d ${V})"
|
|
286
|
+
kv sites "$(ls ${V} 2>/dev/null | wc -l | tr -d ' ')"
|
|
274
287
|
kv network "$(yn S docker network inspect ${`web`})"
|
|
275
|
-
kv proxy "$(grep -v '^#' ${
|
|
288
|
+
kv proxy "$(grep -v '^#' ${U} 2>/dev/null | tr '\n' ' ')"
|
|
276
289
|
if command -v ufw >/dev/null 2>&1; then kv ufw "$(S ufw status 2>/dev/null | awk 'NR == 1 {print $2}')"; else kv ufw missing; fi
|
|
277
|
-
kv hardened "$(yn test -f
|
|
290
|
+
kv hardened "$(yn test -f ${ke})"
|
|
278
291
|
kv password_auth "$(S sshd -T 2>/dev/null | awk '$1 == "passwordauthentication" {print $2}')"
|
|
279
292
|
kv password_users "$(S awk -F: '$2 ~ /^\$/ {printf "%s ", $1}' /etc/shadow 2>/dev/null)"
|
|
280
|
-
f=${
|
|
293
|
+
f=${H}/docker-compose.yml
|
|
281
294
|
if [ ! -f "$f" ]; then kv traefik_compose none
|
|
282
|
-
elif grep -q "managed by
|
|
295
|
+
elif grep -q "managed by landfall" "$f"; then kv traefik_compose landfall
|
|
283
296
|
else kv traefik_compose foreign; fi
|
|
284
297
|
kv traefik_container "$(S docker inspect -f '{{.State.Status}} {{index .Config.Labels "com.docker.compose.project.working_dir"}}' traefik 2>/dev/null)"
|
|
285
298
|
kv publish_80 "$(S docker ps --filter publish=80 --format '{{.Names}}' 2>/dev/null | tr '
|
|
@@ -304,14 +317,14 @@ else
|
|
|
304
317
|
S netstat -ltunp 2>/dev/null | awk '$1 ~ /^tcp/ {print "listen=tcp " $4 " " $7} $1 ~ /^udp/ {print "listen=udp " $4 " " $6}'
|
|
305
318
|
fi
|
|
306
319
|
exit 0
|
|
307
|
-
`,
|
|
320
|
+
`,ze=e=>e.replace(/\$/g,`$$$$`),Be=e=>JSON.stringify(e);function Ve(e){let t=[`--providers.docker=true`,`--providers.docker.exposedbydefault=false`,`--providers.docker.network=web`,`--providers.file.directory=/etc/traefik/dynamic`,`--entrypoints.web.address=:80`,`--entrypoints.web.http.redirections.entrypoint.to=websecure`,`--entrypoints.web.http.redirections.entrypoint.scheme=https`,`--entrypoints.websecure.address=:443`,`--entrypoints.websecure.http.tls.certresolver=le`,`--certificatesresolvers.le.acme.storage=/letsencrypt/acme.json`,`--certificatesresolvers.le.acme.httpchallenge.entrypoint=web`,`--log.level=INFO`,`--accesslog=true`];e.email&&t.push(`--certificatesresolvers.le.acme.email=${e.email}`),e.staging&&t.push(`--certificatesresolvers.le.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory`);let n=[];return e.dashboard&&(t.push(`--api.dashboard=true`),n.push(`traefik.enable=true`,`traefik.http.routers.dashboard.rule=Host(\`${e.dashboard.host}\`)`,`traefik.http.routers.dashboard.entrypoints=websecure`,`traefik.http.routers.dashboard.service=api@internal`,`traefik.http.routers.dashboard.middlewares=dashboard-auth`,`traefik.http.middlewares.dashboard-auth.basicauth.users=${ze(e.dashboard.htpasswd)}`)),`# managed by landfall — regenerate with \`lf traefik setup\`
|
|
308
321
|
services:
|
|
309
322
|
traefik:
|
|
310
323
|
image: ${e.image}
|
|
311
324
|
container_name: traefik
|
|
312
325
|
restart: unless-stopped
|
|
313
326
|
command:
|
|
314
|
-
${t.map(e=>` - ${
|
|
327
|
+
${t.map(e=>` - ${Be(e)}`).join(`
|
|
315
328
|
`)}
|
|
316
329
|
${e.hostNetwork?` network_mode: host
|
|
317
330
|
`:` ports:
|
|
@@ -320,37 +333,104 @@ ${e.hostNetwork?` network_mode: host
|
|
|
320
333
|
`} volumes:
|
|
321
334
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
322
335
|
- ./letsencrypt:/letsencrypt
|
|
336
|
+
- ./dynamic:/etc/traefik/dynamic:ro
|
|
323
337
|
${e.hostNetwork?``:` networks:
|
|
324
338
|
- web
|
|
325
|
-
`}${n.length?` labels:\n${n.map(e=>` - ${
|
|
339
|
+
`}${n.length?` labels:\n${n.map(e=>` - ${Be(e)}`).join(`
|
|
326
340
|
`)}\n`:``}${e.hostNetwork?``:`networks:
|
|
327
341
|
web:
|
|
328
342
|
external: true
|
|
329
|
-
`}`}
|
|
343
|
+
`}`}function He(e){return process.env[`SRV_${e}`]}function Ue(e,t){let n=p(e,`srv`);!o.existsSync(t)&&o.existsSync(p(n,`config.json`))&&o.renameSync(n,t)}const We=`srv.json`,Ge=e=>p(s(),`.ssh`,`srv_${e}`),K=`/opt/srv`,Ke=`[ ! -d ${K} ] || [ -e ${B} ] || { echo "this server still uses ${K} from when landfall was called srv; run 'lf setup' for it once to move it" >&2; exit 3; }\n`,qe=`moved ${K} to ${B} (landfall was called srv); older changes can no longer be undone`,Je=String.raw`
|
|
344
|
+
if [ -n "$SUDO" ] && ! sudo -n true 2>/dev/null; then
|
|
345
|
+
echo "moving ${K} needs root or passwordless sudo for $(id -un) (try: lf setup <name> --user root)" >&2
|
|
346
|
+
exit 1
|
|
347
|
+
fi
|
|
348
|
+
[ ! -e ${B} ] || { echo "both ${K} and ${B} exist; merge them by hand, then remove ${K}" >&2; exit 1; }
|
|
349
|
+
log "moving ${K} to ${B}"
|
|
350
|
+
$SUDO mv ${K} ${B}
|
|
351
|
+
# Only the older journal steps restored these backups; the .env copies hold secrets.
|
|
352
|
+
$SUDO find ${B} /etc/ssh -name '.*.srv-*' -type f -delete 2>/dev/null || true
|
|
353
|
+
$SUDO rm -f ${Pe}.srv-*
|
|
354
|
+
old_conf=/etc/ssh/sshd_config.d/00-srv.conf
|
|
355
|
+
[ ! -f $old_conf ] || $SUDO mv $old_conf ${ke}
|
|
356
|
+
# Rewrite a file in place, keeping its owner (deploy users must still write it).
|
|
357
|
+
rewrite() { o=$($SUDO stat -c %u:%g "$1"); $SUDO sed -i -E "$2" "$1"; $SUDO chown "$o" "$1"; }
|
|
358
|
+
dc version >/dev/null 2>&1 || true
|
|
359
|
+
sdc() { $SUDO $DC "$@"; }
|
|
360
|
+
[ ! -f ${U} ] || rewrite ${U} 's/^# srv routes/# landfall routes/; s/let srv run/let landfall run/'
|
|
361
|
+
f=${H}/docker-compose.yml
|
|
362
|
+
if [ -f $f ] && grep -q "managed by srv" $f; then
|
|
363
|
+
rewrite $f 's/managed by srv/managed by landfall/'
|
|
364
|
+
log "restarting traefik from ${H}"
|
|
365
|
+
(cd ${H} && sdc up -d --force-recreate --quiet-pull)
|
|
366
|
+
fi
|
|
367
|
+
for d in ${V}/*; do
|
|
368
|
+
n=$(basename "$d"); f="$d/docker-compose.yml"
|
|
369
|
+
[ -f "$f" ] && grep -q "managed by srv" "$f" || continue
|
|
370
|
+
rewrite "$f" 's/managed by srv/managed by landfall/; s/^name: srv-/name: landfall-/; s/container_name: srv-/container_name: landfall-/; s/(routers|services|middlewares)\.srv-/\1.landfall-/g; s/middlewares=srv-/middlewares=landfall-/; s/"srv\.(managed|site)=/"landfall.\1=/'
|
|
371
|
+
[ ! -f "$d/nginx.conf" ] || rewrite "$d/nginx.conf" 's/managed by srv/managed by landfall/'
|
|
372
|
+
# A stopped site stays stopped.
|
|
373
|
+
if [ "$($SUDO docker inspect -f '{{.State.Running}}' "srv-$n" 2>/dev/null)" = true ]; then act="up -d"; else act=create; fi
|
|
374
|
+
log "moving srv-$n to landfall-$n"
|
|
375
|
+
if (cd "$d" && sdc $act --quiet-pull >/dev/null); then $SUDO docker rm -f "srv-$n" >/dev/null 2>&1 || true
|
|
376
|
+
else log "landfall-$n did not start, srv-$n keeps running; redeploy $n"; fi
|
|
377
|
+
done
|
|
378
|
+
record "${qe}"
|
|
379
|
+
`;async function Ye(e,t){let{stdout:n}=await R(e,`[ ! -d ${K} ] || echo old`,{capture:!0,oldLayout:!0});return n.trim()!==`old`||(E(`${K} is from when landfall was called srv: its sites, traefik and journal move to ${B}`),T(S.dim(`sites keep running; traefik restarts once; changes made before the move can no longer be undone`)),t.check||!await M(`move /opt/srv to /opt/landfall?`)?!1:(await R(e,G+Je,{oldLayout:!0}),w(`moved to ${B}`),!0))}const Xe=e=>process.env[`LANDFALL_${e}`]??He(e),Ze=process.env.XDG_CONFIG_HOME??p(s(),`.config`),Qe=Xe(`CONFIG_DIR`)??p(Ze,`landfall`),$e=p(Qe,`config.json`);Xe(`CONFIG_DIR`)||Ue(Ze,Qe);const q=e=>e.startsWith(`~/`)?p(s(),e.slice(2)):e,J=e=>{let t=s();return e.startsWith(t+`/`)?`~`+e.slice(t.length):e};function Y(){try{let e=JSON.parse(o.readFileSync($e,`utf8`));e.servers??={};for(let t of Object.values(e.servers))t.domain&&(t.domains=[.../* @__PURE__ */ new Set([t.domain,...t.domains??[]])]),delete t.domain;return e}catch(e){return e.code===`ENOENT`?{servers:{}}:O(`cannot read ${$e}: ${e.message}`)}}function et(e){o.mkdirSync(f($e),{recursive:!0,mode:448}),o.writeFileSync($e,JSON.stringify(e,null,2)+`
|
|
380
|
+
`,{mode:384})}function X(e){let t=Y();if(e??=t.default,!e){let n=Object.keys(t.servers);n.length===1?e=n[0]:n.length===0?O("no server given. Use --server <ssh-alias> or `lf server add`"):O(`several servers configured (${n.join(`, `)}); pick one with --server or \`lf server use\``)}let n=t.servers[e]??{host:e};return{name:e,server:n}}const tt=/^(?=.{1,253}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i,nt=e=>{let t=e.trim().toLowerCase().replace(/^\*\./,``);return tt.test(t)||O(`not a domain: ${e}`),t},rt=/^[a-z0-9][a-z0-9._\-/:@]*$/i,it=e=>rt.test(e)?e:O(`not an image: ${e}`);function at(e,t,n,r=2**53-1){let i=typeof e==`number`?e:/^\s*\d+\s*$/.test(String(e))?Number(e):NaN;return(!Number.isInteger(i)||i<n||i>r)&&O(`${t} must be a whole number from ${n}${r<2**53-1?` to ${r}`:` up`}, got ${e}`),i}const ot=(e,t)=>t?[.../* @__PURE__ */ new Set([t,...e??[]])]:e,st=e=>e.domains?.[0];function ct(e,t){let n=st(t);return e===`@`?n??O("`@` means the main domain, but none is set: lf server domain <server> <domain>"):!e.includes(`.`)&&n?`${e.toLowerCase()}.${n}`:e.toLowerCase()}const lt=/* @__PURE__ */ new Set([`sslip.io`,`nip.io`,`traefik.me`,`localhost`]),ut=e=>{let t=e.toLowerCase().split(`.`),n=t.length>=3&&t.at(-1).length===2&&t.at(-2).length<=3?3:2;return t.slice(-n).join(`.`)};function dt(e){let t=/* @__PURE__ */ new Map;for(let n of new Set(e.map(e=>e.toLowerCase()))){if(!tt.test(n))continue;let e=ut(n);lt.has(e)||t.set(e,(t.get(e)??0)+1)}return[...t].filter(([,e])=>e>=2).sort((e,t)=>t[1]-e[1]).map(([e,t])=>({domain:e,hosts:t}))}const ft=`.landfall.json`,pt=e=>{let t=p(e,ft);return o.existsSync(t)||!o.existsSync(p(e,`srv.json`))?t:p(e,We)};function mt(e){try{return JSON.parse(o.readFileSync(pt(e),`utf8`))}catch{return}}function ht(e,t){o.writeFileSync(p(e,ft),JSON.stringify(t,null,2)+`
|
|
381
|
+
`),o.rmSync(p(e,We),{force:!0})}const gt=Xe(`SSH_CONFIG`)??p(s(),`.ssh`,`config`),_t=/* @__PURE__ */ new Map;function Z(e){let n=[...me(e),`-G`,pe(e)],r=_t.get(n.join(`\0`));if(r)return r;let i;try{i=t(`ssh`,n,{encoding:`utf8`,stdio:[`ignore`,`pipe`,`pipe`]})}catch(t){return O(`ssh cannot resolve ${pe(e)}: ${String(t.stderr??t.message).trim()}`)}let a=e=>i.match(RegExp(`^${e} (.+)$`,`m`))?.[1]??``,o=[...i.matchAll(/^identityfile (.+)$/gm)].map(e=>q(e[1])),s={hostname:a(`hostname`),user:a(`user`),port:Number(a(`port`)||22),identityFiles:o};return _t.set(n.join(`\0`),s),s}function vt(e){return(e.key?[q(e.key)]:Z(e).identityFiles).find(e=>o.existsSync(e)&&o.existsSync(`${e}.pub`))}function yt(e=gt,t=/* @__PURE__ */ new Set){if(t.has(e)||!o.existsSync(e))return[];t.add(e);let n=[];for(let r of o.readFileSync(e,`utf8`).split(`
|
|
382
|
+
`)){let e=r.trim().match(/^(\w+)\s*=?\s*(.+)$/);if(!e)continue;let[,i,a]=e;if(i.toLowerCase()===`host`)n.push(...a.split(/\s+/).filter(e=>!/[*?!]/.test(e)));else if(i.toLowerCase()===`include`)for(let e of a.split(/\s+/)){let r=q(e),i=r.startsWith(`/`)?r:p(s(),`.ssh`,r);for(let e of bt(i))n.push(...yt(e,t))}}return[...new Set(n)]}function bt(e){if(!/[*?[]/.test(e))return[e];let t=f(e);return o.existsSync(t)?o.globSync(d(e),{cwd:t}).map(e=>p(t,e)):[]}const xt=e=>[`# >>> landfall:${e}`,`# <<< landfall:${e}`],St=(e,t)=>RegExp(`# >>> (?:landfall|srv):${At(e)}\\n[\\s\\S]*?# <<< (?:landfall|srv):${At(e)}${t}`),Ct=(e,t)=>e===`# >>> landfall:${t}`||e===`# >>> srv:${t}`;function wt(e){let[t,n]=xt(e.alias);return[t,`Host ${e.alias}`,` HostName ${e.hostname}`,` User ${e.user}`,...e.port===22?[]:[` Port ${e.port}`],` IdentityFile ${e.key}`,` IdentitiesOnly yes`,n].join(`
|
|
383
|
+
`)}function Tt(e,t=gt){let n=!o.existsSync(t),r=n?``:o.readFileSync(t,`utf8`),i=wt(e),a=St(e.alias,`\\n?`),s=a.test(r)?r.replace(a,i+`
|
|
384
|
+
`):`${i}\n\n${r}`;return o.mkdirSync(p(t,`..`),{recursive:!0,mode:448}),o.writeFileSync(t,s,{mode:384}),_t.clear(),{created:n,block:i}}function Et(e,t=gt,n=/* @__PURE__ */ new Set){if(n.has(t)||!o.existsSync(t))return;n.add(t);let r=o.readFileSync(t,`utf8`).split(`
|
|
385
|
+
`);for(let i=0;i<r.length;i++){let a=r[i].trim().match(/^(\w+)\s*=?\s*(.+)$/);if(!a)continue;let o=a[1].toLowerCase();if(o===`host`&&a[2].split(/\s+/).includes(e)){let n=i+1;for(;n<r.length&&!/^\s*(host|match)\b/i.test(r[n])&&!(/* @__PURE__ */ RegExp(`^# <<< (landfall|srv):`)).test(r[n]);)n++;for(;n>i+1&&/^\s*(#.*)?$/.test(r[n-1]);)n--;return{file:t,start:i,end:n,lines:r.slice(i,n),managed:Ct(r[i-1],e)}}if(o===`include`)for(let t of a[2].split(/\s+/)){let r=q(t);for(let t of bt(r.startsWith(`/`)?r:p(s(),`.ssh`,r))){let r=Et(e,t,n);if(r)return r}}}}function Dt(e,t){let n=Et(e);if(!n)return;let r=o.readFileSync(n.file,`utf8`).split(`
|
|
386
|
+
`),i=r.slice(n.start+1,n.end),a=e=>e.trim().match(/^identityfile\s*=?\s*(.+)$/i)?.[1].replace(/^"(.*)"$/,`$1`),s=i.filter(e=>{let n=a(e);return n!==void 0&&(!o.existsSync(q(n))||q(n)===t)}),c=`${i.find(e=>e.trim())?.match(/^\s*/)?.[0]||` `}IdentityFile ${t}`,l=i.filter(e=>!s.includes(e));r.splice(n.start+1,i.length,c,...l);let u=`${n.file}.landfall-bak`;return o.existsSync(u)||o.copyFileSync(n.file,u),o.writeFileSync(n.file,r.join(`
|
|
387
|
+
`)),_t.clear(),{file:n.file,removed:s.map(e=>e.trim()),added:c.trim(),backup:u}}function Ot(e,t=gt){if(!o.existsSync(t))return!1;let n=o.readFileSync(t,`utf8`),r=St(e,`\\n*`);return r.test(n)?(o.writeFileSync(t,n.replace(r,``)),!0):!1}const kt=(e,t=gt)=>o.existsSync(t)&&o.readFileSync(t,`utf8`).split(`
|
|
388
|
+
`).some(t=>Ct(t,e)),At=e=>e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`),jt=String.raw`
|
|
389
|
+
set +e
|
|
390
|
+
kv() { printf '%s=%s\n' "$1" "$2"; }
|
|
391
|
+
PRETTY_NAME=unknown; ID=; VERSION_ID=; ID_LIKE=; . /etc/os-release 2>/dev/null
|
|
392
|
+
kv os "$PRETTY_NAME"
|
|
393
|
+
kv id "$ID"
|
|
394
|
+
kv version "$VERSION_ID"
|
|
395
|
+
kv like "$ID_LIKE"
|
|
396
|
+
kv arch "$(uname -m)"
|
|
397
|
+
kv kernel "$(uname -r)"
|
|
398
|
+
kv uptime "$(cut -d' ' -f1 /proc/uptime 2>/dev/null)"
|
|
399
|
+
kv cpus "$(nproc 2>/dev/null || getconf _NPROCESSORS_ONLN 2>/dev/null)"
|
|
400
|
+
kv load "$(cut -d' ' -f1-3 /proc/loadavg 2>/dev/null)"
|
|
401
|
+
kv mem "$(awk '/^MemTotal:/ {t=$2} /^MemAvailable:/ {a=$2} END {print t, a}' /proc/meminfo 2>/dev/null)"
|
|
402
|
+
kv disk "$(df -Pk / 2>/dev/null | awk 'NR==2 {print $2, $3, $4}')"
|
|
403
|
+
kv pkg "$(pkg_mgr)"
|
|
404
|
+
kv docker "$(docker version --format '{{.Server.Version}}' 2>/dev/null)"
|
|
405
|
+
# The source address of the default route; behind NAT that is a private one.
|
|
406
|
+
kv ip4 "$(ip -4 route get 1.1.1.1 2>/dev/null | sed -n 's/.* src \([0-9.]*\).*/\1/p' | head -n1)"
|
|
407
|
+
kv ip6 "$(ip -6 route get 2606:4700:4700::1111 2>/dev/null | sed -n 's/.* src \([0-9a-fA-F:]*\).*/\1/p' | head -n1)"
|
|
408
|
+
kv reboot "$([ -f /var/run/reboot-required ] && echo 1)"
|
|
409
|
+
exit 0
|
|
410
|
+
`;function Mt(e,t=/* @__PURE__ */ new Date){let n={};for(let t of e.split(`
|
|
411
|
+
`)){let e=t.indexOf(`=`);e>0&&(n[t.slice(0,e)]=t.slice(e+1).trim())}let r=(e=``)=>e.split(/\s+/).map(e=>Number(e)*1024),[i=0,a=0]=r(n.mem),[o=0,s=0,c=0]=r(n.disk);return{os:n.os||`unknown`,id:n.id??``,version:n.version??``,like:n.like??``,arch:n.arch??``,kernel:n.kernel??``,uptime:Math.round(Number(n.uptime)||0),cpus:Number(n.cpus)||0,load:n.load??``,mem:{total:i||0,available:a||0},disk:{total:o||0,used:s||0,available:c||0},pkg:n.pkg||`none`,docker:n.docker??``,ip4:n.ip4??``,ip6:n.ip6??``,reboot:n.reboot===`1`,support:Ft(n.id??``,n.version??``,n.pkg||`none`,t)}}async function Nt(e){let{stdout:t}=await R(e,G+jt,{capture:!0});return Mt(t)}const Pt={"ubuntu 18.04":`2023-05-31`,"ubuntu 20.04":`2025-05-31`,"ubuntu 22.04":`2027-06-01`,"ubuntu 23.10":`2024-07-11`,"ubuntu 24.04":`2029-05-31`,"ubuntu 24.10":`2025-07-10`,"ubuntu 25.04":`2026-01-15`,"ubuntu 25.10":`2026-07-09`,"ubuntu 26.04":`2031-05-31`,"debian 9":`2022-06-30`,"debian 10":`2024-06-30`,"debian 11":`2026-08-31`,"debian 12":`2028-06-30`,"debian 13":`2030-06-30`,"centos 7":`2024-06-30`,"centos 8":`2021-12-31`,"rhel 8":`2029-05-31`,"rhel 9":`2032-05-31`,"rocky 8":`2029-05-31`,"rocky 9":`2032-05-31`,"almalinux 8":`2029-05-31`,"almalinux 9":`2032-05-31`,"alpine 3.17":`2024-11-22`,"alpine 3.18":`2025-05-09`,"alpine 3.19":`2025-11-01`,"alpine 3.20":`2026-04-01`,"alpine 3.21":`2026-11-01`,"alpine 3.22":`2027-05-01`};function Ft(e,t,n,r=/* @__PURE__ */ new Date){if(n===`none`)return{level:`unsupported`,note:`no apt, dnf, yum, apk or zypper: setup cannot install packages`};let i=t.split(`.`)[0],a=t.split(`.`).slice(0,2).join(`.`),o=Pt[`${e} ${t}`]??Pt[`${e} ${a}`]??Pt[`${e} ${i}`];if(!o)return{level:`ok`};let s=(Date.parse(o)-r.getTime())/864e5;return s<0?{level:`eol`,note:`${e} ${t} reached end of life on ${o}: no more security updates, upgrade the release`}:s<90?{level:`ok`,note:`${e} ${t} reaches end of life on ${o}`}:{level:`ok`}}const It=/^(10\.|127\.|169\.254\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.|100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\.)/,Lt=e=>g(e)===4&&!It.test(e);async function Rt(e,t){let n=Z(e).hostname,r=g(n)?[n]:await ee.resolve4(n).catch(()=>[]);return[.../* @__PURE__ */ new Set([...r,...t?.ip4?[t.ip4]:[]])]}const zt=e=>e.find(Lt)??e[0],Bt=(e,t)=>`${e}.${t.replace(/\./g,`-`)}.sslip.io`;async function Vt(e,t){return Promise.all(e.map(async e=>{let n=await ee.resolve4(e).catch(()=>[]);return{domain:e,ips:n,ok:n.some(e=>t.includes(e))}}))}const Ht=e=>{let t=[`B`,`K`,`M`,`G`,`T`],n=0;for(;e>=1024&&n<t.length-1;)e/=1024,n++;return`${e<10&&n?e.toFixed(1):Math.round(e)}${t[n]}`},Ut=e=>{let t=Math.floor(e/86400),n=Math.floor(e%86400/3600);return t?`${t}d ${n}h`:n?`${n}h ${Math.floor(e%3600/60)}m`:`${Math.floor(e/60)}m`},Wt=e=>e.v!==2,Gt=e=>e.project??e.name,Kt=e=>Wt(e)?void 0:e.releases.find(t=>t.id===e.current),qt=e=>!!(e.port||e.own),Jt=e=>!!e.port&&!e.domains&&!e.own,Yt=e=>e?.services.find(Jt),Xt=e=>e.adopted?void 0:Yt(Kt(e)),Zt=e=>`landfall-${e}`,Qt=e=>e.adopted?`adopted`:Wt(e)?`old`:`managed`,$t=e=>({managed:e.kind,adopted:`adopted`,old:`${e.kind} (old)`})[Qt(e)],en=e=>/^up/i.test(e),tn=e=>/^exited \(0\)/i.test(e);function Q(e){let t=Kt(e);if(!t)return e.domains;let n=t.services.flatMap(e=>e.domains??[]);return[.../* @__PURE__ */ new Set([...Yt(t)?e.domains:[],...n])]}const nn=(e,t,n)=>`${e}-${t.toLowerCase()}:${n}`,rn=[`compose.yaml`,`compose.yml`,`docker-compose.yaml`,`docker-compose.yml`],an=[`compose.override.yaml`,`compose.override.yml`,`docker-compose.override.yaml`,`docker-compose.override.yml`],on=e=>[...e.matchAll(/\bHost\(([^)]*)\)/g)].flatMap(e=>[...e[1].matchAll(/[`"]([^`"]+)[`"]/g)].map(e=>e[1].toLowerCase())),sn=/^traefik\.http\.routers\.[^.]+\.rule$/;function cn(e,t,n=e=>e){let r=[],i=[],a=[];for(let[o,s]of Object.entries(e?.services??{})){let e=s[`x-landfall`]??{},c=Array.isArray(s.labels)?Object.fromEntries(s.labels.map(e=>[e.slice(0,e.indexOf(`=`)),e.slice(e.indexOf(`=`)+1)])):s.labels??{},l={name:o,networks:s.network_mode?[]:Object.keys(s.networks??{default:null})};s.build&&(l.build=!0);let u=Object.entries(c).filter(([e])=>sn.test(e));if(typeof e!=`object`||Array.isArray(e))i.push(`${o}: x-landfall must be a mapping, like x-landfall: { port: 3000 }`);else if(u.length)l.own=!0,l.domains=[...new Set(u.flatMap(([,e])=>on(e)))],Object.keys(e).some(e=>e!==`publish`)&&a.push(`${o} has its own traefik router labels: its x-landfall routing is ignored`);else if(s[`x-landfall`]!==void 0){let t=Object.keys(e).filter(e=>![`port`,`domains`,`publish`].includes(e));t.length&&a.push(`${o}: x-landfall knows port, domains and publish, not ${t.join(`, `)}`);let r=(s.expose??[]).map(String),c=e.port??(r.length===1?r[0]:void 0),u=Number(c);if(c!==void 0&&Number.isInteger(u)&&u>=1&&u<=65535?l.port=u:e.port===void 0?(e.domains||!e.publish)&&i.push(`${o}: x-landfall needs the port Traefik should send requests to, like x-landfall: { port: 3000 }`):i.push(`${o}: x-landfall.port must be a port number, got ${JSON.stringify(e.port)}`),e.domains!==void 0){let t=(Array.isArray(e.domains)?e.domains:[e.domains]).map(e=>n(String(e).trim())),r=t.filter(e=>!tt.test(e));r.length&&i.push(`${o}: not a domain in x-landfall.domains: ${r.join(`, `)}`),t.length||i.push(`${o}: x-landfall.domains is empty; leave it out to serve the site's domains`),l.domains=t}}if(s.network_mode&&(qt(l)?i.push(`${o}: a routed service cannot use network_mode: ${s.network_mode}; Traefik reaches it over a network`):s.network_mode===`host`&&a.push(`${o} uses network_mode: host: it binds ports on the server itself`)),s.ports?.length&&!e.publish){let e=s.ports.map(e=>e.published?`${e.host_ip?e.host_ip+`:`:``}${e.published}:${e.target}`:String(e.target));i.push(`${o} publishes ${e.join(`, `)} on the server, past Traefik and the firewall. Move ports: to compose.override.yaml (local only)${l.port||l.own?``:` and route it with x-landfall: { port: ${s.ports[0].target} }`}, or allow it with x-landfall: { publish: true }`)}for(let e of s.volumes??[]){let n=String(e.source??``);if(e.type===`bind`&&!e.read_only&&(n===t||n.startsWith(t+`/`))){let r=n===t?`.`:`./`+n.slice(t.length+1);i.push(`${o} writes to ${r}, which stays behind in the release on the next deploy: use a named volume (e.g. ${o}-data:${e.target}), or mount it read-only (:ro)`)}}s.container_name&&a.push(`${o} sets container_name ${s.container_name}: names are global on the server, leave it out unless something needs it`),r.push(l)}r.some(qt)||i.push(`no service is routed: add x-landfall: { port: <port> } to the one Traefik should serve`);let o=r.filter(Jt);o.length>1&&i.push(`${o.map(e=>e.name).join(` and `)} both serve the site's domains: give all but one their own x-landfall.domains`);let s=/* @__PURE__ */ new Map;for(let e of r)for(let t of e.domains??[])s.has(t)&&i.push(`${t} is routed to both ${s.get(t)} and ${e.name}`),s.set(t,e.name);return{services:r,errors:i,warnings:a}}const ln=e=>JSON.stringify(e),un=e=>e.replace(/\$/g,`$$$$`),dn=`landfall-proxy`;function fn(e,t,n,r,i=[]){let a=`${e}-${t.name.toLowerCase()}`,o={"traefik.enable":`true`,"traefik.docker.network":r.network,[`traefik.http.routers.${a}.rule`]:n.map(e=>`Host(\`${e}\`)`).join(` || `),[`traefik.http.routers.${a}.entrypoints`]:r.entrypoint,[`traefik.http.routers.${a}.tls.certresolver`]:r.resolver,[`traefik.http.routers.${a}.service`]:a,[`traefik.http.services.${a}.loadbalancer.server.port`]:String(t.port)};return i.length&&(o[`traefik.http.middlewares.${e}-auth.basicauth.users`]=i.join(`,`),o[`traefik.http.routers.${a}.middlewares`]=`${e}-auth`),o}function pn(e,t,n=Ae){let r=[`# generated by landfall: rewritten on every deploy, rollback and domain change. Edit compose.yaml instead.`,`name: ${ln(Gt(e))}`,`services:`],i=!1;for(let a of t.services){r.push(` ${ln(a.name)}:`),a.build&&r.push(` image: ${ln(nn(e.name,a.name,t.id))}`);let o={};qt(a)&&(i=!0,r.push(` networks:`,...a.networks.map(e=>` ${ln(e)}: {}`),` ${dn}: {}`),a.own?o[`traefik.docker.network`]=n.network:o=fn(e.name,a,a.domains??e.domains,n,e.auth)),o[`landfall.managed`]=`true`,o[`landfall.site`]=e.name,r.push(` labels:`,...Object.entries(o).map(([e,t])=>` ${ln(e)}: ${ln(un(t))}`))}return i&&r.push(`networks:`,` ${dn}:`,` name: ${ln(n.network)}`,` external: true`),r.join(`
|
|
412
|
+
`)+`
|
|
413
|
+
`}function mn(e,t={}){let n=`# generated by landfall for a ${e===`static`?`static folder`:e===`image`?`prebuilt image`:`Dockerfile`}; \`lf init\` writes one you can edit into your project\nservices:\n`;return e===`static`?`${n} web:
|
|
414
|
+
image: nginx:alpine
|
|
415
|
+
restart: unless-stopped
|
|
330
416
|
volumes:
|
|
331
|
-
- ./
|
|
332
|
-
- ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
|
|
333
|
-
|
|
334
|
-
|
|
335
|
-
|
|
336
|
-
|
|
337
|
-
app:
|
|
338
|
-
${i}
|
|
339
|
-
container_name: ${Z(e.name)}
|
|
417
|
+
- ./public:/usr/share/nginx/html:ro
|
|
418
|
+
- ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
|
|
419
|
+
x-landfall:
|
|
420
|
+
port: 80
|
|
421
|
+
`:`${n} app:
|
|
422
|
+
${e===`image`?`image: ${ln(t.image)}`:`build: .`}
|
|
340
423
|
restart: unless-stopped
|
|
341
|
-
|
|
342
|
-
-
|
|
343
|
-
|
|
344
|
-
|
|
345
|
-
|
|
346
|
-
|
|
347
|
-
${t.network}:
|
|
348
|
-
external: true
|
|
349
|
-
`}function ht(e,t){return`# managed by srv
|
|
424
|
+
env_file:
|
|
425
|
+
- path: .env
|
|
426
|
+
required: false
|
|
427
|
+
x-landfall:
|
|
428
|
+
port: ${t.port??3e3}
|
|
429
|
+
`}function hn(e){return`# generated by landfall
|
|
350
430
|
server {
|
|
351
431
|
listen 80;
|
|
352
432
|
server_name _;
|
|
353
|
-
root /
|
|
433
|
+
root /usr/share/nginx/html;
|
|
354
434
|
index index.html;
|
|
355
435
|
absolute_redirect off;
|
|
356
436
|
|
|
@@ -364,56 +444,39 @@ server {
|
|
|
364
444
|
}
|
|
365
445
|
|
|
366
446
|
location / {
|
|
367
|
-
try_files $uri $uri/ $uri.html ${
|
|
447
|
+
try_files $uri $uri/ $uri.html ${e?`/index.html`:`=404`};
|
|
368
448
|
}
|
|
369
449
|
|
|
370
450
|
error_page 404 /404.html;
|
|
371
451
|
location = /404.html { internal; }
|
|
372
452
|
}
|
|
373
|
-
`}const
|
|
374
|
-
|
|
375
|
-
|
|
376
|
-
|
|
377
|
-
|
|
378
|
-
|
|
379
|
-
kv version "$VERSION_ID"
|
|
380
|
-
kv like "$ID_LIKE"
|
|
381
|
-
kv arch "$(uname -m)"
|
|
382
|
-
kv kernel "$(uname -r)"
|
|
383
|
-
kv uptime "$(cut -d' ' -f1 /proc/uptime 2>/dev/null)"
|
|
384
|
-
kv cpus "$(nproc 2>/dev/null || getconf _NPROCESSORS_ONLN 2>/dev/null)"
|
|
385
|
-
kv load "$(cut -d' ' -f1-3 /proc/loadavg 2>/dev/null)"
|
|
386
|
-
kv mem "$(awk '/^MemTotal:/ {t=$2} /^MemAvailable:/ {a=$2} END {print t, a}' /proc/meminfo 2>/dev/null)"
|
|
387
|
-
kv disk "$(df -Pk / 2>/dev/null | awk 'NR==2 {print $2, $3, $4}')"
|
|
388
|
-
kv pkg "$(pkg_mgr)"
|
|
389
|
-
kv docker "$(docker version --format '{{.Server.Version}}' 2>/dev/null)"
|
|
390
|
-
# The source address of the default route; behind NAT that is a private one.
|
|
391
|
-
kv ip4 "$(ip -4 route get 1.1.1.1 2>/dev/null | sed -n 's/.* src \([0-9.]*\).*/\1/p' | head -n1)"
|
|
392
|
-
kv ip6 "$(ip -6 route get 2606:4700:4700::1111 2>/dev/null | sed -n 's/.* src \([0-9a-fA-F:]*\).*/\1/p' | head -n1)"
|
|
393
|
-
kv reboot "$([ -f /var/run/reboot-required ] && echo 1)"
|
|
394
|
-
exit 0
|
|
395
|
-
`;function _t(e,t=/* @__PURE__ */ new Date){let n={};for(let t of e.split(`
|
|
396
|
-
`)){let e=t.indexOf(`=`);e>0&&(n[t.slice(0,e)]=t.slice(e+1).trim())}let r=(e=``)=>e.split(/\s+/).map(e=>Number(e)*1024),[i=0,a=0]=r(n.mem),[o=0,s=0,c=0]=r(n.disk);return{os:n.os||`unknown`,id:n.id??``,version:n.version??``,like:n.like??``,arch:n.arch??``,kernel:n.kernel??``,uptime:Math.round(Number(n.uptime)||0),cpus:Number(n.cpus)||0,load:n.load??``,mem:{total:i||0,available:a||0},disk:{total:o||0,used:s||0,available:c||0},pkg:n.pkg||`none`,docker:n.docker??``,ip4:n.ip4??``,ip6:n.ip6??``,reboot:n.reboot===`1`,support:bt(n.id??``,n.version??``,n.pkg||`none`,t)}}async function vt(e){let{stdout:t}=await V(e,X+gt,{capture:!0});return _t(t)}const yt={"ubuntu 18.04":`2023-05-31`,"ubuntu 20.04":`2025-05-31`,"ubuntu 22.04":`2027-06-01`,"ubuntu 23.10":`2024-07-11`,"ubuntu 24.04":`2029-05-31`,"ubuntu 24.10":`2025-07-10`,"ubuntu 25.04":`2026-01-15`,"ubuntu 25.10":`2026-07-09`,"ubuntu 26.04":`2031-05-31`,"debian 9":`2022-06-30`,"debian 10":`2024-06-30`,"debian 11":`2026-08-31`,"debian 12":`2028-06-30`,"debian 13":`2030-06-30`,"centos 7":`2024-06-30`,"centos 8":`2021-12-31`,"rhel 8":`2029-05-31`,"rhel 9":`2032-05-31`,"rocky 8":`2029-05-31`,"rocky 9":`2032-05-31`,"almalinux 8":`2029-05-31`,"almalinux 9":`2032-05-31`,"alpine 3.17":`2024-11-22`,"alpine 3.18":`2025-05-09`,"alpine 3.19":`2025-11-01`,"alpine 3.20":`2026-04-01`,"alpine 3.21":`2026-11-01`,"alpine 3.22":`2027-05-01`};function bt(e,t,n,r=/* @__PURE__ */ new Date){if(n===`none`)return{level:`unsupported`,note:`no apt, dnf, yum, apk or zypper: setup cannot install packages`};let i=t.split(`.`)[0],a=t.split(`.`).slice(0,2).join(`.`),o=yt[`${e} ${t}`]??yt[`${e} ${a}`]??yt[`${e} ${i}`];if(!o)return{level:`ok`};let s=(Date.parse(o)-r.getTime())/864e5;return s<0?{level:`eol`,note:`${e} ${t} reached end of life on ${o}: no more security updates, upgrade the release`}:s<90?{level:`ok`,note:`${e} ${t} reaches end of life on ${o}`}:{level:`ok`}}const xt=/^(10\.|127\.|169\.254\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.|100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\.)/,St=e=>g(e)===4&&!xt.test(e);async function Ct(e,t){let n=W(e).hostname,r=g(n)?[n]:await h.resolve4(n).catch(()=>[]);return[.../* @__PURE__ */ new Set([...r,...t?.ip4?[t.ip4]:[]])]}const wt=e=>e.find(St)??e[0],Tt=(e,t)=>`${e}.${t.replace(/\./g,`-`)}.sslip.io`;async function Et(e,t){return Promise.all(e.map(async e=>{let n=await h.resolve4(e).catch(()=>[]);return{domain:e,ips:n,ok:n.some(e=>t.includes(e))}}))}const Dt=e=>{let t=[`B`,`K`,`M`,`G`,`T`],n=0;for(;e>=1024&&n<t.length-1;)e/=1024,n++;return`${e<10&&n?e.toFixed(1):Math.round(e)}${t[n]}`},Ot=e=>{let t=Math.floor(e/86400),n=Math.floor(e%86400/3600);return t?`${t}d ${n}h`:n?`${n}h ${Math.floor(e%3600/60)}m`:`${Math.floor(e/60)}m`},kt=[`dist`,`build`,`out`,`public`,`_site`,`site`];function At(e){return o.existsSync(p(e,`index.html`))?`.`:kt.find(t=>o.existsSync(p(e,t,`index.html`)))??`.`}function jt(e){let t=o.readFileSync(e,`utf8`).match(/^\s*EXPOSE\s+(\d+)/im);return t?Number(t[1]):void 0}const Mt=e=>e.toLowerCase().replace(/[^a-z0-9-]+/g,`-`).replace(/^-+|-+$/g,``).slice(0,63)||`site`;function Nt(e){let t=Te(e),n=t?.name??Mt(d(e));if(t?.image&&!t.static)return{path:e,name:n,kind:`image`,port:t.port,project:t};let r=t=>o.existsSync(p(e,t)),i=t?.build;if(!i&&r(`package.json`))try{JSON.parse(o.readFileSync(p(e,`package.json`),`utf8`)).scripts?.build&&(i=r(`bun.lock`)||r(`bun.lockb`)?`bun run build`:r(`pnpm-lock.yaml`)?`pnpm build`:r(`yarn.lock`)?`yarn build`:`npm run build`)}catch{}if(!t?.static&&r(`Dockerfile`))return{path:e,name:n,kind:`dockerfile`,port:t?.port??jt(p(e,`Dockerfile`))??3e3,project:t};let a=t?.dir??At(e);return{path:e,name:n,kind:`static`,dir:a!==`.`||r(`index.html`)?a:void 0,build:i,project:t}}const Pt=p(ue,`projects.json`);function Ft(){try{return JSON.parse(o.readFileSync(Pt,`utf8`)).filter(e=>o.existsSync(e.path))}catch{return[]}}function It(e){let t=ee(e.path),n=[{...e,path:t,at:(/* @__PURE__ */ new Date()).toISOString()},...Ft().filter(e=>e.path!==t)].slice(0,50);o.mkdirSync(ue,{recursive:!0,mode:448}),o.writeFileSync(Pt,JSON.stringify(n,null,2)+`
|
|
397
|
-
`,{mode:384})}function Lt(e,t,n){let r=Ft();for(let i of r.filter(n=>n.server===e&&n.name===t)){i.domains=n;let e=p(i.path,`srv.json`),r=Te(i.path);r?.name===t&&o.writeFileSync(e,JSON.stringify({...r,domains:n},null,2)+`
|
|
398
|
-
`)}r.length&&o.writeFileSync(Pt,JSON.stringify(r,null,2)+`
|
|
399
|
-
`,{mode:384})}const Q=e=>`${K}/${e}`;function Rt(e){return/^[a-z0-9][a-z0-9-]{0,62}$/.test(e)||D(`invalid site name "${e}" (use lowercase letters, digits, dashes)`),e}const zt=`
|
|
400
|
-
--8<--srv--8<--
|
|
401
|
-
`;async function Bt(e,t){let n=Q(t),{stdout:r}=await V(e,[...[`${n}/site.json`,`${n}/.env`,J].map(e=>`cat ${B(e)} 2>/dev/null || true`),`[ ! -d ${B(n)} ] || echo 1`].join(`; printf %s ${B(zt)}; `),{capture:!0}),[i,a=``,o=``,s=``]=r.split(zt),c;if(i.trim())try{c=JSON.parse(i)}catch{D(`corrupt ${n}/site.json on ${e.host}`)}return{meta:c,env:a,proxy:at(o)??rt,exists:s.trim()===`1`}}async function Vt(e,t){let n=await Bt(e,t);return n.meta||D(`no site "${t}" on ${e.host}. See \`lf sites list\``),n}const Ht=e=>[...e.releases].sort((e,t)=>t.id.localeCompare(e.id)),Ut=(e,t,n)=>Le(e,[`docker logs --tail ${B(n.tail??`100`)} ${n.follow?`-f `:``}${t}`]);async function Wt(e){let{stdout:t}=await V(e,`printf 'READY\\t%s\\n' "$([ -d ${K} ] && command -v docker >/dev/null 2>&1 && echo 1)"
|
|
402
|
-
P=${it}
|
|
453
|
+
`}const gn=[`dist`,`build`,`out`,`public`,`_site`,`site`];function _n(e){return o.existsSync(p(e,`index.html`))?`.`:gn.find(t=>o.existsSync(p(e,t,`index.html`)))??`.`}function vn(e){let t=o.readFileSync(e,`utf8`).match(/^\s*EXPOSE\s+(\d+)/im);return t?Number(t[1]):void 0}const yn=e=>e.toLowerCase().replace(/[^a-z0-9-]+/g,`-`).replace(/^-+|-+$/g,``).slice(0,63)||`site`;function bn(e,t){if(t?.compose)return t.compose;if(!(t?.image||t?.static))return rn.find(t=>o.existsSync(p(e,t)))}function xn(e){let t=mt(e),n=t?.name??yn(d(e)),r=bn(e,t);if(r)return{path:e,name:n,kind:`compose`,compose:r,project:t};if(t?.image&&!t.static)return{path:e,name:n,kind:`image`,port:t.port,project:t};let i=t=>o.existsSync(p(e,t)),a=t?.build;if(!a&&i(`package.json`))try{JSON.parse(o.readFileSync(p(e,`package.json`),`utf8`)).scripts?.build&&(a=i(`bun.lock`)||i(`bun.lockb`)?`bun run build`:i(`pnpm-lock.yaml`)?`pnpm build`:i(`yarn.lock`)?`yarn build`:`npm run build`)}catch{}if(!t?.static&&i(`Dockerfile`))return{path:e,name:n,kind:`dockerfile`,port:t?.port??vn(p(e,`Dockerfile`))??3e3,project:t};let s=t?.dir??_n(e);return{path:e,name:n,kind:`static`,dir:s!==`.`||i(`index.html`)?s:void 0,build:a,project:t}}const Sn=p(Qe,`projects.json`);function Cn(){try{return JSON.parse(o.readFileSync(Sn,`utf8`)).filter(e=>o.existsSync(e.path))}catch{return[]}}function wn(e){let t=h(e.path),n=[{...e,path:t,at:(/* @__PURE__ */ new Date()).toISOString()},...Cn().filter(e=>e.path!==t)].slice(0,50);o.mkdirSync(Qe,{recursive:!0,mode:448}),o.writeFileSync(Sn,JSON.stringify(n,null,2)+`
|
|
454
|
+
`,{mode:384})}function Tn(e,t,n){let r=Cn();for(let i of r.filter(n=>n.server===e&&n.name===t)){i.domains=n;let e=mt(i.path);e?.name===t&&ht(i.path,{...e,domains:n})}r.length&&o.writeFileSync(Sn,JSON.stringify(r,null,2)+`
|
|
455
|
+
`,{mode:384})}const $=e=>`${V}/${e}`;function En(e){return/^[a-z0-9][a-z0-9-]{0,62}$/.test(e)||O(`invalid site name "${e}" (use lowercase letters, digits, dashes)`),e}const Dn=`
|
|
456
|
+
--8<--landfall--8<--
|
|
457
|
+
`;async function On(e,t){let n=$(t),{stdout:r}=await R(e,[...[`${n}/site.json`,`${n}/.env`,U].map(e=>`cat ${L(e)} 2>/dev/null || true`),`[ ! -d ${L(n)} ] || echo 1`].join(`; printf %s ${L(Dn)}; `),{capture:!0}),[i,a=``,o=``,s=``]=r.split(Dn),c;if(i.trim())try{c=JSON.parse(i)}catch{O(`corrupt ${n}/site.json on ${e.host}`)}return{meta:c,env:a,proxy:Me(o)??Ae,exists:s.trim()===`1`}}async function kn(e,t,n={}){let r=await On(e,t);r.meta||O(`no site "${t}" on ${e.host}. See \`lf sites list\``);let i=r.meta;return Wt(i)&&O(`${t} was deployed by an older landfall: run \`lf deploy\` in its project once to move it to a Compose project`),n.deployed&&i.adopted&&O(`${t} is adopted (${i.adopted}): landfall does not ${n.deployed} it; change its compose files there`),r}const An=e=>[...e.releases].sort((e,t)=>t.id.localeCompare(e.id)),jn=(e,t,n)=>be(e,[`docker logs --tail ${L(n.tail??`100`)} ${n.follow?`-f `:``}${t}`]);function Mn(e,t,n,r=/* @__PURE__ */ new Set){let i=/* @__PURE__ */ new Map;for(let{name:a,labels:o}of e){if(a===n||o[`landfall.managed`]||o[`srv.managed`]||o[`traefik.enable`]===`false`)continue;let e=o[`com.docker.compose.project`];if(e&&r.has(e))continue;let s=Object.entries(o).filter(([e])=>sn.test(e)).flatMap(([,e])=>on(e));if(!s.length)continue;let c=e||a,l=i.get(c)??{name:c,domains:[],status:``,containers:[],dir:o[`com.docker.compose.project.working_dir`],files:o[`com.docker.compose.project.config_files`]};l.domains=[.../* @__PURE__ */ new Set([...l.domains,...s])],l.containers.push(a);let u=t.get(a)??`not running`;l.status&&en(u)||(l.status=u),i.set(c,l)}return[...i.values()].sort((e,t)=>e.name.localeCompare(t.name))}function Nn(e,t){if(!t.length)return`not running`;let n=Kt(e),r=new Set(n?.services.filter(qt).map(e=>e.name)),i=t.filter(e=>r.has(e.service));return(i.find(e=>!en(e.status))??t.find(e=>!r.has(e.service)&&!en(e.status)&&!tn(e.status))??i[0]??t[0]).status}const Pn=e=>Wt(e)?Zt(e.name):Gt(e);async function Fn(e){let{stdout:t}=await R(e,`printf 'READY\\t%s\\n' "$([ -d ${V} ] && command -v docker >/dev/null 2>&1 && echo 1)"
|
|
458
|
+
P=${je}
|
|
403
459
|
printf 'TRAEFIK\\t%s\\t%s\\n' "$(docker ps -a --filter "name=^$P$" --format '{{.Status}}' 2>/dev/null || true)" "$P"
|
|
404
|
-
for f in ${
|
|
405
|
-
docker ps -a --
|
|
406
|
-
|
|
407
|
-
|
|
460
|
+
for f in ${V}/*/site.json; do [ -f "$f" ] || continue; printf 'SITE\\t'; tr -d '\\n' < "$f"; echo; done
|
|
461
|
+
docker ps -a --format 'CTR\\t{{.Names}}\\t{{.Status}}\\t{{.Label "com.docker.compose.project"}}\\t{{.Label "com.docker.compose.service"}}' 2>/dev/null || true
|
|
462
|
+
ids=$(docker ps -aq 2>/dev/null || true)
|
|
463
|
+
# inspect, unlike ps, does not expand \\t: hence {{"\\t"}}.
|
|
464
|
+
[ -z "$ids" ] || docker inspect -f 'LABELS{{"\\t"}}{{.Name}}{{"\\t"}}{{json .Config.Labels}}' $ids 2>/dev/null || true`,{capture:!0}),n=/* @__PURE__ */ new Map,r=/* @__PURE__ */ new Map,i=[],a=[],o={ready:!1,traefik:``,proxy:`traefik`,sites:[],others:[]};for(let s of t.split(`
|
|
465
|
+
`)){let[t,c=``,l=``,u=``,d=``]=s.split(` `);if(t===`READY`&&(o.ready=c===`1`),t===`TRAEFIK`&&(o.traefik=c,o.proxy=l||`traefik`),t===`SITE`)try{i.push(JSON.parse(s.slice(t.length+1)))}catch{E(`skipped a corrupt site.json on ${e.host}: ${s.slice(5,80)}`)}if(t===`CTR`&&(n.set(c,l),u&&r.set(u,[...r.get(u)??[],{service:d||c,container:c,status:l}])),t===`LABELS`)try{a.push({name:c.replace(/^\//,``),labels:JSON.parse(l??`null`)??{}})}catch{}}return o.others=Mn(a,n,o.proxy,new Set(i.map(Pn))),o.sites=i.map(e=>{let t=(r.get(Pn(e))??[]).sort((e,t)=>e.service.localeCompare(t.service));return{meta:e,status:Nn(e,t),services:t,domains:Q(e),main:Xt(e)?.name,state:Qt(e),kind:$t(e)}}),o}async function In(e,t,n,r={}){let i=`${$(t)}/releases/${n}`,a=[...rn,...an].filter(e=>e!==`compose.yaml`),{stdout:o}=await R(e,[G,`v=$(dc version --short 2>/dev/null | sed 's/^v//'); case "$v" in 2.2[4-9]*|2.[3-9][0-9]*|[3-9]*) ;; *) echo "sites need docker compose 2.24 or newer, the server has \${v:-none}: run lf update --compose" >&2; exit 1 ;; esac`,`mkdir -p ${L(i)} && cd -P ${L(i)}`,`[ -e ../../.env ] || { touch ../../.env && chmod 600 ../../.env; }`,`ln -sfn ../../.env .env`,...Object.entries(r.generated??{}).map(([e,t])=>z(e,t)),...r.file&&r.file!==`compose.yaml`?[`mv -f ${L(r.file)} compose.yaml`]:[],`rm -f ${a.map(L).join(` `)}`,...r.env===void 0?[]:[z(`.env.next`,r.env,`600`)],`[ -f compose.yaml ] || { echo "no compose.yaml in the upload" >&2; cfg=; false; } && cfg=$(dc ${r.env===void 0?``:`--env-file .env.next `}-f compose.yaml config 2>&1) || {`,` printf '%s\\n' "$cfg" >&2; exit 1`,`}`,`rm -f .env.next`,`pwd -P; printf %s ${L(Dn)}; printf '%s\\n' "$cfg"`].join(`
|
|
466
|
+
`),{capture:!0}),[s,c=``]=o.split(Dn),l;try{l=_(c)}catch(e){O(`could not read \`docker compose config\` of ${t}: ${e?.message??e}`)}return{dir:s.trim(),config:l}}async function Ln(e,t){let n=$(t.name);await R(e,[G,`[ -r ${L(t.adopted)} ] && [ -x ${L(t.adopted)} ] || { echo "$(id -un) cannot read ${t.adopted}; adopt it as a user who can (lf server config)" >&2; exit 1; }`,`[ ! -e ${L(n)} ] || { echo "${n} exists already" >&2; exit 1; }`,`mkdir -p ${L(n)} && cd ${L(n)}`,`ln -s ${L(t.adopted)} current`,z(`site.json`,JSON.stringify(t,null,2)+`
|
|
467
|
+
`),`record ${L(`adopted ${t.project} as site ${t.name}`)} ${L(`rm -rf ${n}`)}`].join(`
|
|
468
|
+
`))}async function Rn(e,t,n){let r=$(t);await R(e,`cd / && rm -rf ${L(`${r}/releases/${n}`)}; [ -f ${L(r+`/site.json`)} ] || { rmdir ${L(r+`/releases`)} 2>/dev/null; rm -f ${L(r+`/.env`)}; rmdir ${L(r)} 2>/dev/null; } || true`)}const zn=e=>[`log "starting ${e}"`,`(cd -P current && dc up -d --wait --wait-timeout 300 --remove-orphans --quiet-pull) || { log "${e} did not start:"; (cd -P current && dc ps -a >&2; dc logs --tail 30 >&2) || true; exit 1; }`];function Bn(e,t,n={}){let r=$(e.name),i=Kt(e),a=[`mkdir -p ${L(r)} && cd ${L(r)}`,z(`site.json`,JSON.stringify(e,null,2)+`
|
|
469
|
+
`),n.env===void 0?`[ -e .env ] || { touch .env && chmod 600 .env; }`:z(`.env`,n.env,`600`),`(cd -P ${L(`releases/`+e.current)} && ${z(`compose.override.yaml`,pn(e,i,t))}) || exit 1`];return n.build&&i.services.some(e=>e.build)&&a.push(`log "building ${e.name}"`,`(cd -P ${L(`releases/`+e.current)} && dc build -q) || exit 1`),n.pull&&a.push(`log "pulling images of ${e.name}"`,`(cd -P ${L(`releases/`+e.current)} && dc pull -q --ignore-buildable) || exit 1`),a.push(`ln -sfn ${L(`releases/`+e.current)} current.new && mv -Tf current.new current`,...zn(e.name)),a}const Vn=(e,t)=>(t.services??[]).filter(e=>e.build).map(n=>nn(e.name,n.name,t.id)),Hn=(e,t)=>[`rm -rf ${L(`${$(e.name)}/releases/${t.id}`)} 2>/dev/null || $SUDO rm -rf ${L(`${$(e.name)}/releases/${t.id}`)}`,...Vn(e,t).map(e=>`docker image rm ${L(e)} >/dev/null 2>&1 || true`)];function Un(e){let t=$(e.name),n=e.kind===`dockerfile`?e.releases.map(e=>e.image).filter(Boolean):[];return[`cd ${L(t)}`,`log "removing the old container of ${e.name}"`,`dc -p ${L(Zt(e.name))} down --remove-orphans >/dev/null 2>&1 || docker rm -f ${L(Zt(e.name))} >/dev/null 2>&1 || true`,`rm -f docker-compose.yml nginx.conf`,...e.releases.map(e=>`rm -rf ${L(`releases/`+e.id)}`),...n.map(e=>`docker image rm ${L(e)} >/dev/null 2>&1 || true`)]}async function Wn(e,t,n,r){let i=Math.max(Number.isInteger(r.keep)?r.keep:5,2),a=An(t),o=a.filter((e,n)=>n<i||e.id===t.current||e.id===r.prev?.current),s=a.filter(e=>!o.includes(e));t.releases=o;let c=$(t.name),l=[G];if(r.takeover){l.push(`record ${L(`${r.what} (moved from landfall's old site layout, cannot be undone)`)}`,...Bn(t,n,r),...Un(r.takeover)),await R(e,l.join(`
|
|
470
|
+
`));return}let u,d=``,f=r.prev?r.env!==void 0:!!r.existed;if(f&&l.push(`u=$(saved ${L(c+`/.env`)})`),!r.prev)u=`[ ! -d ${L(c)} ] || {\n${qn(t,{keepDir:r.existed}).join(`
|
|
408
471
|
`)}\n`,d=`
|
|
409
|
-
}`;else{let e=r.prev,i={...e,releases:e.releases.filter(e=>o.some(t=>t.id===e.id))},a=o.filter(t=>!e.releases.some(e=>e.id===t.id));u=`[ -d ${
|
|
410
|
-
`+[...
|
|
411
|
-
`)}l.push(`record ${
|
|
412
|
-
`))}async function
|
|
413
|
-
`))}function
|
|
472
|
+
}`;else{let e=r.prev,i={...e,releases:e.releases.filter(e=>o.some(t=>t.id===e.id))},a=o.filter(t=>!e.releases.some(e=>e.id===t.id));u=`[ -d ${L(c)} ] || { log ${L(`${t.name} was removed since, nothing to put back`)}; exit 0; }\n`,d=`
|
|
473
|
+
`+[...Bn(i,n),...a.flatMap(e=>Hn(t,e))].join(`
|
|
474
|
+
`)}l.push(`record ${L(r.what)} ${L(u)}${f?`"$u"`:``}${L(d)}`),l.push(...Bn(t,n,r));for(let e of s)l.push(...Hn(t,e));await R(e,l.join(`
|
|
475
|
+
`))}async function Gn(e,t,n,r=``){await R(e,`${G}\ncd ${L($(t))}\n${r}\ncd -P current && dc ${n}`)}const Kn=(e,t,n)=>be(e,[`cd -P ${L($(t)+`/current`)} && docker compose logs --tail ${L(n.tail??`100`)} ${n.follow?`-f `:``}${n.service?L(n.service):``}`]);function qn(e,t={}){let n=$(e.name),r=t.volumes?` -v`:``,i=e.adopted?[]:e.releases.flatMap(t=>Vn(e,t)),a=[`site.json`,`current`,`current.new`,...e.releases.map(e=>`releases/${e.id}`)].map(L).join(` `);return[`cd ${L(n)}`,`{ [ -e current ] && (cd -P current && dc down --remove-orphans${r}); } >/dev/null 2>&1 || dc -p ${L(Pn(e))} down --remove-orphans${r} >/dev/null 2>&1 || true`,...i.map(e=>`docker image rm ${L(e)} >/dev/null 2>&1 || true`),...t.keepDir?[`rm -rf ${a} 2>/dev/null || $SUDO rm -rf ${a}`,`rmdir releases 2>/dev/null || true`]:[`cd /`,`rm -rf ${L(n)} 2>/dev/null || $SUDO rm -rf ${L(n)}`]]}async function Jn(e,t,n={}){let r=`removed site ${t.name} (${Q(t).join(`, `)||`no domains`})${n.volumes?` and its volumes`:``}`;await R(e,[G,...qn(t,n),`record ${L(r)}`].join(`
|
|
476
|
+
`))}function Yn(e,t,n=[]){let r=[],i=new Map(Object.entries(t));for(let t of e.split(`
|
|
414
477
|
`)){let e=t.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/)?.[1];e&&n.includes(e)||(e&&i.has(e)?(r.push(`${e}=${i.get(e)}`),i.delete(e)):(t.trim()||r.length)&&r.push(t))}for(;r.length&&!r[r.length-1].trim();)r.pop();for(let[e,t]of i)r.push(`${e}=${t}`);return r.length?r.join(`
|
|
415
478
|
`)+`
|
|
416
|
-
`:``}function
|
|
479
|
+
`:``}function Xn(e){let t={};for(let n of e){let e=n.indexOf(`=`);e<1&&O(`invalid env "${n}", expected KEY=VALUE`),t[n.slice(0,e)]=n.slice(e+1)}return t}async function Zn(e,t){let{stdout:n}=await R(e,`{ [ "$(id -u)" = 0 ] || sudo -n true 2>/dev/null; } && echo yes || true`,{capture:!0});if(n.trim()===`yes`)return e;let r={...e,user:`root`};return Z(e).user!==`root`&&await Se(r)?r:O(`${t} needs root or passwordless sudo; ${Z(e).user} has neither and root's key login does not work`)}const Qn=String.raw`
|
|
417
480
|
set +e
|
|
418
481
|
S() { if [ -n "$SUDO" ]; then sudo -n "$@"; else "$@"; fi; }
|
|
419
482
|
m=$(pkg_mgr); echo "mgr=$m"
|
|
@@ -433,8 +496,8 @@ case "$m" in
|
|
|
433
496
|
esac
|
|
434
497
|
[ -f /var/run/reboot-required ] && echo reboot=1
|
|
435
498
|
exit 0
|
|
436
|
-
`;function
|
|
437
|
-
`)){let e=r.indexOf(`=`);if(e<0)continue;let[i,a]=[r.slice(0,e),r.slice(e+1)];if(i===`mgr`&&(t.mgr=a.trim()),i===`refreshed`&&(t.refreshed=!0),i===`reboot`&&(t.reboot=!0),i===`sec`&&n.push(a.trim()),i===`pkg`){let[e,n,r,i=``]=a.split(` `);t.updates.push({name:e,from:n||void 0,to:r,security:/security/i.test(i)})}if(i===`apk`){let[e,n]=a.split(` `),r=e.match(/^(.*)-(\d[^-]*-r\d+)$/);t.updates.push({name:r?.[1]??e,from:r?.[2],to:n,security:!1})}}for(let e of t.updates){let t=e.name.replace(/\.[^.]+$/,``);n.some(e=>e.startsWith(t+`-`))&&(e.security=!0)}return t}async function
|
|
499
|
+
`;function $n(e){let t={mgr:`none`,updates:[],refreshed:!1,reboot:!1},n=[];for(let r of e.split(`
|
|
500
|
+
`)){let e=r.indexOf(`=`);if(e<0)continue;let[i,a]=[r.slice(0,e),r.slice(e+1)];if(i===`mgr`&&(t.mgr=a.trim()),i===`refreshed`&&(t.refreshed=!0),i===`reboot`&&(t.reboot=!0),i===`sec`&&n.push(a.trim()),i===`pkg`){let[e,n,r,i=``]=a.split(` `);t.updates.push({name:e,from:n||void 0,to:r,security:/security/i.test(i)})}if(i===`apk`){let[e,n]=a.split(` `),r=e.match(/^(.*)-(\d[^-]*-r\d+)$/);t.updates.push({name:r?.[1]??e,from:r?.[2],to:n,security:!1})}}for(let e of t.updates){let t=e.name.replace(/\.[^.]+$/,``);n.some(e=>e.startsWith(t+`-`))&&(e.security=!0)}return t}async function er(e,t=!0){let{stdout:n}=await R(e,G+Qn,{capture:!0,env:{REFRESH:t}});return $n(n)}const tr=String.raw`
|
|
438
501
|
if [ -n "$SUDO" ] && ! sudo -n true 2>/dev/null; then echo "upgrading packages needs root or passwordless sudo" >&2; exit 1; fi
|
|
439
502
|
keep="-o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold"
|
|
440
503
|
case "$(pkg_mgr)" in
|
|
@@ -454,8 +517,8 @@ if [ "$REBOOT" = 1 ] && { [ -f /var/run/reboot-required ] || { command -v needs-
|
|
|
454
517
|
# Detached, so this ssh session can end cleanly first.
|
|
455
518
|
(sleep 2; $SUDO systemctl reboot 2>/dev/null || $SUDO reboot) >/dev/null 2>&1 &
|
|
456
519
|
fi
|
|
457
|
-
`;async function
|
|
458
|
-
${
|
|
520
|
+
`;async function nr(e,t){await R(e,G+tr,{env:{ONLY:(t.only??[]).join(` `),WHAT:t.what,REBOOT:!!t.reboot}})}function rr(e){let[t,n]=e.split(`@`),r=`latest`,i=t.lastIndexOf(`:`);i>t.lastIndexOf(`/`)&&(r=t.slice(i+1),t=t.slice(0,i));let a=t.split(`/`)[0],o=`registry-1.docker.io`;return t.includes(`/`)&&(a.includes(`.`)||a.includes(`:`)||a===`localhost`)&&(o=a===`docker.io`?o:a,t=t.slice(a.length+1)),o===`registry-1.docker.io`&&!t.includes(`/`)&&(t=`library/${t}`),{registry:o,repo:t,tag:r,digest:n}}async function ir(e,t,n=`GET`){let r=t.startsWith(`https://`)?t:`https://${e.registry}/v2/${e.repo}/${t}`,i=AbortSignal.timeout(1e4),a=e=>fetch(r,{method:n,signal:i,headers:{accept:`application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.docker.distribution.manifest.v2+json, application/vnd.oci.image.manifest.v1+json`,...e?{authorization:e}:{}}});try{let t=await a();if(t.status===401){let n=t.headers.get(`www-authenticate`)??``,r=Object.fromEntries([...n.matchAll(/(\w+)="([^"]*)"/g)].map(e=>[e[1],e[2]]));if(!/^bearer/i.test(n)||!r.realm)return;let o=new URL(r.realm);r.service&&o.searchParams.set(`service`,r.service),o.searchParams.set(`scope`,r.scope??`repository:${e.repo}:pull`);let s=await fetch(o,{signal:i}).then(e=>e.ok?e.json():void 0),c=s?.token??s?.access_token;if(!c)return;t=await a(`Bearer ${c}`)}return t.ok?t:void 0}catch{return}}async function ar(e){let t=rr(e);return t.digest?t.digest:(await ir(t,`manifests/${t.tag}`,`HEAD`))?.headers.get(`docker-content-digest`)||void 0}async function or(e){let t=rr(e),n=[],r=`tags/list?n=1000`;for(let e=0;r&&e<10;e++){let e=await ir(t,r);if(!e)break;n.push(...(await e.json().catch(()=>({}))).tags??[]);let i=e.headers.get(`link`)?.match(/<([^>]+)>;\s*rel="next"/)?.[1];r=i?`https://${t.registry}${i}`:void 0}return n}function sr(e,t){let n=e.replace(/^v/,``).split(/[.+-]/).map(Number),r=t.replace(/^v/,``).split(/[.+-]/).map(Number);for(let e=0;e<Math.max(n.length,r.length);e++){let t=(n[e]||0)-(r[e]||0);if(t)return t}return 0}const cr=/^(v?)(\d+(?:\.\d+){0,2})$/;function lr(e,t){let n=cr.exec(e);if(!n)return;let r=n[2].split(`.`).length,i=n[2];for(let e of t){let t=cr.exec(e);t&&t[1]===n[1]&&t[2].split(`.`).length===r&&sr(t[2],i)>0&&(i=t[2])}return i===n[2]?void 0:n[1]+i}const ur=(e,t)=>`${e.slice(0,e.lastIndexOf(`:`))}:${t}`,dr=/* @__PURE__ */ new Map;function fr(e){return dr.has(e)||dr.set(e,fetch(`https://github.com/${e}/releases/latest`,{method:`HEAD`,redirect:`manual`,signal:AbortSignal.timeout(1e4)}).then(e=>e.headers.get(`location`)?.match(/\/tag\/(?:docker-)?v?([^/]+)$/)?.[1]).catch(()=>void 0)),dr.get(e)}const pr=()=>fr(`moby/moby`),mr=()=>fr(`docker/compose`);async function hr(e){let t=String.raw`
|
|
521
|
+
${G}
|
|
459
522
|
set +e
|
|
460
523
|
printf 'docker=%s
|
|
461
524
|
' "$(docker version --format '{{.Server.Version}}' 2>/dev/null)"
|
|
@@ -465,60 +528,81 @@ printf 'path=%s
|
|
|
465
528
|
' "$(docker info --format '{{range .ClientInfo.Plugins}}{{if eq .Name "compose"}}{{.Path}}{{end}}{{end}}' 2>/dev/null)"
|
|
466
529
|
printf 'ce=%s
|
|
467
530
|
' "$(pkg_has docker-ce && echo 1)"
|
|
468
|
-
exit 0`,[{stdout:n},r,i]=await Promise.all([
|
|
469
|
-
`).map(e=>[e.slice(0,e.indexOf(`=`)),e.slice(e.indexOf(`=`)+1).trim()]));return{docker:a.docker??``,compose:a.compose??``,composePath:a.path??``,dockerCe:a.ce===`1`,latestDocker:r,latestCompose:i}}function
|
|
470
|
-
`)}const
|
|
531
|
+
exit 0`,[{stdout:n},r,i]=await Promise.all([R(e,t,{capture:!0}),pr(),mr()]),a=Object.fromEntries(n.split(`
|
|
532
|
+
`).map(e=>[e.slice(0,e.indexOf(`=`)),e.slice(e.indexOf(`=`)+1).trim()]));return{docker:a.docker??``,compose:a.compose??``,composePath:a.path??``,dockerCe:a.ce===`1`,latestDocker:r,latestCompose:i}}function gr(e){let t=(e,t)=>!!e&&!!t&&sr(e,t)<0,n=t(e.docker,e.latestDocker)?`docker ${e.docker}, ${e.latestDocker} is current${e.dockerCe?` (comes with the package upgrades)`:` (distro package: switch to Docker's repo for the newest)`}`:void 0,r=t(e.compose,e.latestCompose)&&e.composePath===`/usr/local/lib/docker/cli-plugins/docker-compose`;return{dockerNote:n,composeNote:e.compose?t(e.compose,e.latestCompose)?`compose ${e.compose}, ${e.latestCompose} is current${r?``:e.dockerCe?` (comes with the package upgrades)`:` (from ${e.composePath||`the distro`})`}`:void 0:`docker compose missing: lf setup installs it`,composeUpdate:r}}async function _r(e){await R(e,G+Fe+`compose_install || { log "could not download docker compose"; exit 1; }
|
|
533
|
+
`)}const vr=String.raw`
|
|
471
534
|
set +e
|
|
472
|
-
P=${
|
|
473
|
-
img() { # img <kind> <name> <container> <dir>
|
|
474
|
-
|
|
475
|
-
|
|
476
|
-
|
|
535
|
+
P=${je}
|
|
536
|
+
img() { # img <kind> <name> <container> <dir> [service]
|
|
537
|
+
svc=; [ $# -lt 5 ] || svc=$5
|
|
538
|
+
x=$(docker inspect -f '{{.Config.Image}} {{.Image}}' "$3" 2>/dev/null) || { printf 'IMG\t%s\t%s\t%s\t%s\t%s\t\t\n' "$1" "$2" "$3" "$4" "$svc"; return 0; }
|
|
539
|
+
read -r ref id <<EOF
|
|
540
|
+
$x
|
|
541
|
+
EOF
|
|
542
|
+
printf 'IMG\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' "$1" "$2" "$3" "$4" "$svc" "$ref" "$(docker image inspect -f '{{range .RepoDigests}}{{.}} {{end}}' "$id" 2>/dev/null)"
|
|
477
543
|
}
|
|
478
|
-
if [ "$P" = traefik ] && grep -q "managed by
|
|
544
|
+
if [ "$P" = traefik ] && grep -q "managed by landfall" ${H}/docker-compose.yml 2>/dev/null; then img traefik traefik traefik ${H}
|
|
479
545
|
else img proxy "$P" "$P" ""; fi
|
|
480
|
-
|
|
546
|
+
# All containers at once: <name> <service> <project>, the last two empty outside Compose.
|
|
547
|
+
PS=$(docker ps -a --format '{{.Names}} {{.Label "com.docker.compose.service"}} {{.Label "com.docker.compose.project"}}' 2>/dev/null)
|
|
548
|
+
for f in ${V}/*/site.json; do
|
|
481
549
|
[ -f "$f" ] || continue
|
|
482
550
|
d=$(dirname "$f"); n=$(basename "$d")
|
|
483
|
-
|
|
484
|
-
img site "$n" "
|
|
551
|
+
# Sites of landfall before Compose sites: one container, its compose file next to site.json.
|
|
552
|
+
if ! grep -q '"v": *2' "$f"; then img site "$n" "landfall-$n" "$d"; continue; fi
|
|
553
|
+
p=$(sed -n 's/^ *"project": *"\([^"]*\)".*/\1/p' "$f"); [ -n "$p" ] || p=$n
|
|
554
|
+
printf '%s\n' "$PS" | while read -r c svc pr; do [ "$pr" != "$p" ] || img site "$n" "$c" "$d/current" "$svc"; done
|
|
485
555
|
done
|
|
486
556
|
exit 0
|
|
487
|
-
`;async function
|
|
488
|
-
`).filter(e=>e.startsWith(`IMG `)).map(e=>e.split(` `)),r=/* @__PURE__ */ new Map,i=/* @__PURE__ */ new Map,a=async e=>{let t=e.slice(0,e.lastIndexOf(`:`));if(!
|
|
489
|
-
`))}function
|
|
490
|
-
`)){let e=n.indexOf(`=`);if(e<0)continue;let r=n.slice(0,e),i=n.slice(e+1).trim();r===`listen`||r===`published`?t[r].push(
|
|
557
|
+
`;async function yr(e){let{stdout:t}=await R(e,vr,{capture:!0}),n=t.split(`
|
|
558
|
+
`).filter(e=>e.startsWith(`IMG `)).map(e=>e.split(` `)),r=/* @__PURE__ */ new Map,i=/* @__PURE__ */ new Map,a=async e=>{let t=e.slice(0,e.lastIndexOf(`:`));if(!cr.test(rr(e).tag))return;i.has(t)||i.set(t,or(e));let n=lr(rr(e).tag,await i.get(t));return n&&ur(e,n)};return Promise.all(n.map(async([,e,t,n,i,o=``,s=``,c=``])=>{let l={name:t,container:n,dir:i,ref:s,service:o||void 0};if(e===`site`&&s.startsWith(`${t}-`)&&/:\d{14}$/.test(s))return{...l,kind:`site`,state:`rebuild`,note:`built on the server: redeploy to rebuild`};if(!s)return{...l,kind:e,state:`missing`,note:`no container`};if(e===`proxy`)return{...l,kind:`proxy`,state:`foreign`,note:`not landfall's traefik: update it where it was set up`};if(s.includes(`@`))return{...l,kind:e,state:`pinned`,note:`pinned to a digest`};r.has(s)||r.set(s,ar(s));let[u,d]=await Promise.all([r.get(s),a(s)]),f=e,p=e=>rr(e).tag.replace(/^v/,``).split(`.`)[0],m=f===`traefik`?`lf traefik setup --image ${d}`:`redeploy with it`,h=d?{newer:d,note:`newer version ${d} (${p(d)===p(s)?``:`new major, read its upgrade notes; `}${m})`}:{};return u?{...l,kind:f,state:c.split(` `).some(e=>e.endsWith(`@${u}`))?`current`:`update`,...h}:{...l,kind:f,state:`unknown`,note:`registry did not answer (private image?)`,...h}}))}async function br(e,t){let n=/* @__PURE__ */ new Map;for(let e of t)n.set(e.ref,[...n.get(e.ref)??[],e]);let r=[G];for(let[e,t]of n){r.push(`log ${L(`pulling ${e}`)}`,`docker pull -q ${L(e)} >/dev/null`,`new=$(docker image inspect -f '{{.Id}}' ${L(e)})`);for(let n of t){let t=n.service?` ${L(n.service)}`:``,i=`docker tag $old ${L(e)} && cd -P ${L(n.dir)} && dc up -d${t}`;r.push(`old=$(docker inspect -f '{{.Image}}' ${L(n.container)})`,`if [ "$old" = "$new" ]; then log ${L(`${n.name} already runs the newest ${e}`)}; else`,` record ${L(`updated ${n.name} to the newest ${e}`)} "${i.replace(/"/g,`\\"`)}"`,` log ${L(`recreating ${n.container}`)}`,` (cd -P ${L(n.dir)} && dc up -d --quiet-pull${t}) && ensure_running ${L(n.container)} || exit 1`,`fi`)}}await R(e,r.join(`
|
|
559
|
+
`))}function xr(e){let t=e.split(` `),n=t[0]===`udp`?`udp`:`tcp`;/^(tcp|udp)/.test(t[0])&&t.shift();let[r,i=``]=t,a=r.lastIndexOf(`:`);return{proto:n,addr:r.slice(0,a),port:Number(r.slice(a+1)),proc:i.match(/"([^"]+)"/)?.[1]??i.split(`/`)[1]??(i||`?`)}}function Sr(e){let t={values:{},listen:[],published:[],rules:[]};for(let n of e.split(`
|
|
560
|
+
`)){let e=n.indexOf(`=`);if(e<0)continue;let r=n.slice(0,e),i=n.slice(e+1).trim();r===`listen`||r===`published`?t[r].push(xr(i)):r===`ufw_rule`?t.rules.push(i):t.values[r]=i}return t}async function Cr(e,t={}){let{stdout:n}=await R(e,G+Re,{env:{PUBKEY:t.PUBKEY??``,DEPLOY_USER:t.DEPLOY_USER??``},capture:!0});return Sr(n)}const wr=e=>/^(127\.|\[?::1\]?(%|$)|localhost)/.test(e),Tr=e=>e.includes(`:`),Er=e=>e.proto===`tcp`?`${e.port}`:`${e.port}/udp`,Dr=[68,546,5353];function Or(e){let t=e.match(/^(.*?)\s+comment\s+'(.*)'$/),n=Fr(t?t[1]:e),r=e=>n.includes(e)?n[n.indexOf(e)+1]:void 0,i=[`allow`,`deny`,`reject`,`limit`].find(e=>e===n[0])??`allow`,a=r(`port`),o=r(`proto`);if(!n.includes(`to`)&&!n.includes(`from`)){let e=n.find(e=>/^[\d,:]+(\/(tcp|udp))?$/.test(e));[a,o]=e?.split(`/`)??[]}let s=r(`from`);return{spec:e,action:i,port:a,proto:o===`tcp`||o===`udp`?o:void 0,from:s&&s!==`any`?s:void 0,comment:t?.[2],out:n[1]===`out`}}function kr(e,t){let n=e.findIndex(e=>!e.out&&(!e.proto||e.proto===t.proto)&&!!e.port?.split(`,`).some(e=>{let[n,r=n]=e.split(`:`).map(Number);return t.port>=n&&t.port<=r}));return n<0?void 0:{rule:e[n],n:n+1}}const Ar=(e,t)=>{let n=kr(e,t)?.rule;return!!n&&(n.action===`allow`||n.action===`limit`)&&!n.from},jr=(e,t)=>[...new Map([...e].sort((e,t)=>e.port-t.port||e.proto.localeCompare(t.proto)).map(e=>[Er(e),t(e)])).values()];function Mr(e,t){let n=(e,t)=>({part:`firewall`,label:`firewall`,status:e,detail:t}),{blocked:r,kept:i}=Nr(e,[t.sshPort,80,443]);return r.length?n(`conflict`,`enabling ufw would block ${r.join(`, `)}`):n(`todo`,`enable ufw (ssh/80/443)${i.length?`; docker keeps ${i.join(` `)} open`:``}`)}function Nr(e,t){let n=e.values,r=e.rules.map(Or),i=e=>e.proto===`tcp`&&t.includes(e.port)||e.proto===`udp`&&Dr.includes(e.port)||Ar(r,e),a=e=>!wr(e.addr)&&!i(e),o=e.listen.filter(e=>e.proc!==`docker-proxy`&&a(e)),s=[...e.published,...e.listen.filter(e=>e.proc===`docker-proxy`)].filter(a),c=n.docker_fw===`nftables`,l=s.filter(e=>n[Tr(e.addr)?`docker_nat6`:`docker_nat4`]!==`1`),u=e.published.length>0||e.listen.some(e=>e.proc===`docker-proxy`);return{blocked:[...jr(o,e=>`${Er(e)} (${e.proc})`),...c?u?[`every published container port, 80/443 too (docker uses nftables)`]:[]:jr(l,e=>`${Er(e)} (docker${Tr(e.addr)?`, IPv6`:``})`)],kept:c?[]:jr(s.filter(e=>!l.includes(e)),Er)}}function Pr(e){let t=e.values,n=e.rules.map(Or),r=t.ufw===`active`,i=e=>t.docker_fw!==`nftables`&&t[Tr(e.addr)?`docker_nat6`:`docker_nat4`]===`1`,a=(e,a)=>{if(wr(e.addr))return{state:`local`,why:`localhost only`};if(!r)return{state:`open`,why:`open, firewall off`};if(a&&i(e))return{state:`open`,why:`open, docker skips ufw`};let o=kr(n,e);if(o){let{rule:e,n:t}=o;return e.action===`deny`||e.action===`reject`?{state:`blocked`,why:`blocked by rule ${t}`}:e.from?{state:`limited`,why:`only from ${e.from} (rule ${t})`}:{state:`open`,why:`allowed by rule ${t}${e.action===`limit`?`, rate-limited`:``}`}}return e.proto===`udp`&&Dr.includes(e.port)?{state:`open`,why:`ufw default rule`}:t.ufw_in===`ACCEPT`?{state:`open`,why:`default policy accepts`}:{state:`blocked`,why:`blocked, no rule`}},o=[...e.published,...e.listen.filter(e=>e.proc===`docker-proxy`)],s=[...e.listen.filter(e=>e.proc!==`docker-proxy`).map(e=>({l:e,docker:!1})),...o.map(e=>({l:e,docker:!0}))],c=/* @__PURE__ */ new Map;for(let{l:e,docker:t}of s.sort((e,t)=>e.l.port-t.l.port||e.l.proto.localeCompare(t.l.proto))){let n=`${Er(e)} ${t?`docker`:e.proc}`,r={port:Er(e),proc:t?`docker`:e.proc,...a(e,t)};c.has(n)&&c.get(n).state!==`local`||c.set(n,r)}return[...c.values()]}const Fr=(e=``)=>e.split(/\s+/).filter(Boolean);function Ir(e){let t=(e,t=``)=>({part:`docker`,label:`docker`,status:e,detail:t});if(!e.docker)return t(`todo`,`install docker and compose`);let n=e.docker.match(/\d+(\.\d+)+/)?.[0]??e.docker;if(e.docker_podman===`1`)return t(`conflict`,`${e.docker} is podman's docker shim; landfall needs Docker Engine (remove podman-docker, then re-run setup)`);let r=[e.docker_running===`1`?``:`start it`,Number(e.compose?.split(`.`)[0])>=2?``:`install compose`].filter(Boolean);if(r.length)return t(`todo`,`docker ${n}, ${r.join(` + `)}`);let i=(e,t=``)=>t&&sr(e,t)<0?` (${t} is current)`:``;return t(`done`,`docker ${n}${i(n,e.docker_latest)}, compose ${e.compose}${i(e.compose,e.compose_latest)}`)}function Lr(e,t){let n=e.values,r=(e,t,n,r=``)=>({part:e,label:t,status:n,detail:r}),i=[],a=n.pkgs_missing??``;i.push(n.pkg===`none`?r(`packages`,`base packages`,`done`,`no supported package manager, skipped`):a.trim()?r(`packages`,`base packages`,`todo`,`install ${a.trim()}`):r(`packages`,`base packages`,`done`)),i.push(Ir(n));let o=n.root_dir===`1`&&n.network===`1`,s=Number(n.sites||0);if(i.push(r(`layout`,B,o?`done`:`todo`,o?`${s} site${s===1?``:`s`} (never touched by setup)`:`create dir and network`)),t.deployUser){let e=`deploy user ${t.deployUser}`;if(n.user!==`1`)i.push(r(`user`,e,`todo`,`create`));else{let t=[n.user_docker===`1`?``:`docker group`,n.user_key===`1`?``:`ssh key`].filter(Boolean);i.push(r(`user`,e,t.length?`todo`:`done`,t.length?`exists, add ${t.join(` + `)}`:``))}}if(t.firewall?n.ufw===`missing`?i.push(r(`firewall`,`firewall`,`done`,`ufw not available, skipped`)):n.ufw===`active`?i.push(r(`firewall`,`firewall`,`done`,`ufw active (landfall only adds ssh/80/443)`)):i.push(Mr(e,t)):i.push(r(`firewall`,`firewall`,`off`)),!t.harden)i.push(r(`harden`,`ssh hardening`,`off`));else if(n.hardened===`1`)i.push(r(`harden`,`ssh hardening`,`done`));else{let e=Fr(n.password_users).filter(e=>e!==`root`&&e!==t.loginUser&&e!==t.deployUser);i.push(e.length&&n.password_auth!==`no`?r(`harden`,`ssh hardening`,`conflict`,`${e.join(`, `)} would lose ssh password login`):r(`harden`,`ssh hardening`,`todo`,`keys only`))}return t.traefik?i.push(Br(e)):i.push(r(`traefik`,`traefik`,`off`)),i}function Rr(e=``){let[t=``,n=``,r=``,i=``]=e.split(`|`);if(!/traefik/.test(n))return;let a=t.replace(/^\//,``),o=e=>i.match(e)?.[1],s=o(/--entrypoints\.([\w-]+)\.address=[^\s]*:443\b/),c=r.split(`,`).filter(e=>e&&e!==`bridge`&&e!==`host`),l={container:a,network:o(/--providers\.docker\.network=(\S+)/)??(c.length===1?c[0]:void 0),entrypoint:s,resolver:(s&&o(RegExp(`--entrypoints\\.${s}\\.http\\.tls\\.certresolver=(\\S+)`)))??o(/--certificatesresolvers\.([\w-]+)\./)},u=[`network`,`entrypoint`,`resolver`].filter(e=>!l[e]);return{name:a,proxy:u.length?void 0:l,missing:u}}const zr=e=>`${e.container} (network ${e.network}, entrypoint ${e.entrypoint}, resolver ${e.resolver})`;function Br(e){let t=e.values,n=(e,t,n)=>({part:`traefik`,label:`traefik`,status:e,detail:t,proxy:n}),r=Me(t.proxy??``);if(r)return n(`done`,`sites use your traefik ${zr(r)}`,r);if(t.traefik_compose===`foreign`)return n(`conflict`,`${H}/docker-compose.yml was not written by landfall`);let[i,a]=Fr(t.traefik_container),o=i!==void 0&&a===`/opt/landfall/traefik`;if(i&&!o){let e=Rr(t.foreign_proxy);if(!e||e.name!==`traefik`)return n(`conflict`,`a container named traefik exists that landfall did not create`)}for(let r of[80,443]){let i=Fr(t[`publish_${r}`]).filter(e=>!(o&&e===`traefik`));if(i.length){let e=Rr(t.foreign_proxy);return e?.proxy?n(`todo`,`use your traefik ${zr(e.proxy)}`,e.proxy):e?n(`conflict`,`traefik ${e.name} owns 80/443, its flags don't name the ${e.missing.join(`, `)}: lf traefik use ${e.name} ${e.missing.map(e=>`--${e} …`).join(` `)}`):n(`conflict`,`port ${r} is published by container ${i.join(`, `)}`)}let a=e.listen.find(e=>e.port===r&&e.proc!==`docker-proxy`&&!(o&&e.proc===`traefik`));if(a)return n(`conflict`,`port ${r} is in use by ${a.proc}`)}return o&&i===`running`?n(`done`,`running (config refreshed)`):n(`todo`,o?`${i}, start`:`install`)}function Vr(e){let t={done:S.green(`✓`),todo:S.cyan(`→`),conflict:S.yellow(`!`),off:S.dim(`-`)},n=Math.max(...e.map(e=>e.label.length));for(let r of e){let e=r.status===`off`?S.dim(`disabled`):r.status===`conflict`?S.yellow(r.detail):S.dim(r.detail);T(`${t[r.status]} ${r.label.padEnd(n)} ${e}`)}}async function Hr(e,t){return`${e}:${(await y.hash(t,10)).replace(/^\$2b\$/,`$2y$`)}`}function Ur(e,t){return{email:t.email??e.email,staging:!!(t.staging??e.staging),image:t.image||e.traefikImage||`traefik:v3`,hostNetwork:!!(t.hostNetwork??e.hostNetwork)}}const Wr=e=>[e.image,e.hostNetwork?`host network`:`ports 80/443 published`,e.staging&&`LE staging`].filter(Boolean).join(`, `);async function Gr(e,t,n){let r=Ur(t,n);it(r.image);let{email:i,staging:a}=r;C(`installing traefik`);let o=n.dashboard===`off`?void 0:t.dashboard,s,c=n.dashboard&&n.dashboard!==`off`?ct(n.dashboard,t):n.dashboardPassword&&o?.host;if(c){tt.test(c)||O(`not a dashboard domain: ${c}${c.includes(`.`)?``:` (set a main domain first: lf server domain)`}`);let e=n.dashboard?n.dashboardUser:o?.user??n.dashboardUser;s=n.dashboardPassword??v(12).toString(`base64url`),o={host:c,user:e,htpasswd:await Hr(e,s)}}let l=Ve({...r,dashboard:o});await R(t,`${G}
|
|
491
561
|
ensure_network web
|
|
492
|
-
[ -w ${
|
|
493
|
-
mkdir -p ${
|
|
562
|
+
[ -w ${H} ] || { $SUDO install -d -o "$(id -un)" ${H}; }
|
|
563
|
+
mkdir -p ${H}/letsencrypt ${De} && cd ${H}
|
|
564
|
+
${z(`dynamic/landfall.yml`,`# managed by landfall — rewritten by \`lf traefik setup\`; other files in this folder are yours
|
|
565
|
+
tls:
|
|
566
|
+
options:
|
|
567
|
+
default:
|
|
568
|
+
# Refuse the handshake for a name no certificate covers: no 404, no warning about a bad certificate.
|
|
569
|
+
sniStrict: true
|
|
570
|
+
`)}
|
|
494
571
|
if [ -e docker-compose.yml ]; then
|
|
495
|
-
${
|
|
572
|
+
${z(`.docker-compose.yml.new`,l)}
|
|
573
|
+
# .landfall.sha256: what landfall wrote last. A different file was edited by hand.
|
|
574
|
+
if [ -f .landfall.sha256 ] && ! sha256sum -c --status .landfall.sha256 2>/dev/null && ! cmp -s .docker-compose.yml.new docker-compose.yml && [ -z "${n.force?`1`:``}" ]; then
|
|
575
|
+
diff -u docker-compose.yml .docker-compose.yml.new >&2; rm -f .docker-compose.yml.new
|
|
576
|
+
echo "${H}/docker-compose.yml was edited by hand; the diff above is what landfall would change. Keep your edits: change dynamic/ or the flags instead; overwrite them: lf traefik setup --force" >&2
|
|
577
|
+
exit 1
|
|
578
|
+
fi
|
|
496
579
|
# Same config again: nothing to journal.
|
|
497
580
|
if cmp -s .docker-compose.yml.new docker-compose.yml; then rm -f .docker-compose.yml.new
|
|
498
581
|
else
|
|
499
582
|
u=$(saved docker-compose.yml)
|
|
500
583
|
mv .docker-compose.yml.new docker-compose.yml
|
|
501
|
-
record ${
|
|
584
|
+
record ${L(`reconfigured traefik (${Wr(r)})`)} "cd ${H} && $u && sha256sum docker-compose.yml > .landfall.sha256 && dc up -d --remove-orphans"
|
|
502
585
|
fi
|
|
503
586
|
else
|
|
504
|
-
${
|
|
587
|
+
${z(`docker-compose.yml`,l)}
|
|
505
588
|
# Certificates in letsencrypt/ stay, a later install reuses them.
|
|
506
|
-
record ${
|
|
589
|
+
record ${L(`installed traefik (${Wr(r)})`)} "cd ${H} && dc down --remove-orphans && rm -f docker-compose.yml .landfall.sha256 dynamic/landfall.yml && { rmdir dynamic 2>/dev/null || true; }"
|
|
507
590
|
fi
|
|
508
591
|
log "starting traefik"
|
|
509
592
|
dc up -d --remove-orphans --quiet-pull
|
|
510
593
|
sleep 2 # traefik exits shortly after start on a bad config
|
|
511
|
-
ensure_running traefik
|
|
594
|
+
ensure_running traefik
|
|
595
|
+
sha256sum docker-compose.yml > .landfall.sha256`);let u=Y();u.servers[e]&&(Object.assign(u.servers[e],{email:i,staging:a||void 0,traefikImage:r.image===`traefik:v3`?void 0:r.image,hostNetwork:r.hostNetwork||void 0,dashboard:o}),et(u)),w(`traefik running (${Wr(r)}) — HTTPS certificates from Let's Encrypt`),r.hostNetwork&&T(S.dim(`host network: ufw now decides who reaches 80/443 (landfall's firewall allows both)`)),o&&(w(`dashboard: https://${o.host}`),T(s?`user ${S.bold(o.user)} password ${S.bold(s)}`:S.dim(`user ${o.user}, password unchanged (--dashboard-password to set a new one)`)))}async function Kr(e,t){C(`using traefik ${S.bold(t.container)} for lf sites`),await R(e,`${G}
|
|
512
596
|
docker network inspect ${t.network} >/dev/null 2>&1 || { echo "docker network ${t.network} does not exist" >&2; exit 1; }
|
|
513
|
-
[ -w ${
|
|
514
|
-
u=$(saved ${
|
|
515
|
-
${U
|
|
516
|
-
record ${
|
|
597
|
+
[ -w ${B} ] || $SUDO install -d -o "$(id -un)" ${B}
|
|
598
|
+
u=$(saved ${U})
|
|
599
|
+
${z(U,Ne(t))}
|
|
600
|
+
record ${L(`sites use traefik ${t.container}`)} "$u"`),w(`sites join network ${S.bold(t.network)} with entrypoint ${S.bold(t.entrypoint)} and resolver ${S.bold(t.resolver)}`),T(S.dim(`redeploy existing sites to switch them over; delete ${U} to let landfall run its own traefik again`))}const qr={follow:{type:`boolean`,short:`f`,desc:`follow`},tail:{type:`string`,short:`n`,desc:`lines`,default:`100`}},Jr=F({name:`traefik setup`,summary:`Install or reconfigure Traefik (reverse proxy + automatic HTTPS) on a server. Safe to re-run; refuses if ports 80/443 belong to something else.`,options:{server:I,email:{type:`string`,desc:`contact e-mail for the Let's Encrypt account (optional)`},staging:{type:`boolean`,desc:`Let's Encrypt staging CA, remembered (--no-staging to switch back)`},image:{type:`string`,desc:`traefik image, remembered (default: ${Oe})`},"host-network":{type:`boolean`,desc:`run on the host network: real client IPs, ufw applies; remembered (--no-host-network)`},dashboard:{type:`string`,desc:"serve the traefik dashboard on this domain (basic auth), remembered; `traefik` = traefik.<main domain>, `off` removes it"},"dashboard-user":{type:`string`,desc:`dashboard user`,default:`admin`},"dashboard-password":{type:`string`,desc:`dashboard password (default: generated)`},force:{type:`boolean`,desc:`overwrite a docker-compose.yml that was edited by hand`}},async run(e,t){let{name:n,server:r}=X(t.server),i=Br(await Cr(r));i.status===`conflict`&&O(`not touching ${n}: ${i.detail}`),i.proxy&&O(`${n} already has its own traefik: ${i.detail}. landfall does not reconfigure it (lf traefik use)`),await Gr(n,r,{email:t.email,staging:t.staging,image:t.image,hostNetwork:t[`host-network`],dashboard:t.dashboard,dashboardUser:t[`dashboard-user`],dashboardPassword:t[`dashboard-password`],force:t.force})}}),Yr=F({name:`traefik use`,args:`[container]`,summary:`Deploy sites through a Traefik that already runs on the server (yours, not landfall's).
|
|
517
601
|
|
|
518
602
|
landfall reads network, entrypoint and cert resolver from the container's flags;
|
|
519
|
-
pass them when it is configured by a file. That Traefik is never changed.`,options:{server:
|
|
603
|
+
pass them when it is configured by a file. That Traefik is never changed.`,options:{server:I,network:{type:`string`,desc:`docker network traefik watches (providers.docker.network)`},entrypoint:{type:`string`,desc:`HTTPS entrypoint (the one on :443)`},resolver:{type:`string`,desc:`certificate resolver`}},async run([e],t){let{name:n,server:r}=X(t.server),i=Rr((await Cr(r)).values.foreign_proxy),a=e??i?.name;a||O(`no traefik container publishes port 443 on ${n}; name it: lf traefik use <container>`);let o=i?.name===a?i:void 0,s={container:a,network:t.network??o?.proxy?.network,entrypoint:t.entrypoint??o?.proxy?.entrypoint,resolver:t.resolver??o?.proxy?.resolver},c=[`network`,`entrypoint`,`resolver`].filter(e=>!s[e]);c.length&&O(`could not read the ${c.join(`, `)} of ${a}; pass ${c.map(e=>`--${e}`).join(` `)}`),await Kr(r,s)}}),Xr=F({name:`traefik status`,summary:`Show traefik container state and the routes it serves.`,options:{server:I},async run(e,t){let{server:n}=X(t.server);await R(n,`P=${je}
|
|
520
604
|
if ! docker inspect "$P" >/dev/null 2>&1; then echo "traefik is not installed (lf traefik setup)"; exit 0; fi
|
|
521
|
-
[ -f ${
|
|
605
|
+
[ -f ${U} ] && echo "your own traefik, landfall only routes sites through it (${U})"
|
|
522
606
|
docker ps -a --filter "name=^$P$" --format '{{.Names}} {{.Image}} {{.Status}} network {{.Networks}}'
|
|
523
607
|
echo
|
|
524
608
|
echo "routes:"
|
|
@@ -542,44 +626,104 @@ docker ps --filter label=traefik.enable=true --format '{{.Names}}' | while read
|
|
|
542
626
|
printf " %s %s (%s)\\n", n, x, s
|
|
543
627
|
}
|
|
544
628
|
}' || true
|
|
545
|
-
done | sort`)}}),
|
|
546
|
-
|
|
547
|
-
|
|
548
|
-
|
|
629
|
+
done | sort`)}}),Zr=F({name:`traefik logs`,summary:`Show traefik logs (certificate errors show up here).`,options:{server:I,...qr},async run(e,t){return jn(X(t.server).server,je,t)}}),Qr=F({name:`traefik restart`,summary:`Restart traefik.`,options:{server:I},async run(e,t){let{server:n}=X(t.server);await R(n,`${G}\ndocker restart ${je} >/dev/null\nrecord "restarted traefik"`),w(`traefik restarted`)}});function $r(e,t){let n=mt(process.cwd()),r=e??n?.name;return r||O(`which site? pass a name or run inside a folder with .landfall.json`),{site:r,...X(t??n?.server)}}const ei=e=>en(e)?S.green(e):tn(e)?S.dim(e):S.red(e),ti=F({name:`sites list`,summary:`List deployed sites on a server.`,options:{server:I,json:{type:`boolean`,desc:`machine-readable output`},others:{type:`boolean`,desc:`with --json: {sites, others}, others = containers Traefik routes that landfall did not deploy`}},async run(e,t){let{name:n,server:r}=X(t.server??mt(process.cwd())?.server),{sites:i,others:a}=await Fn(r);if(t.json)return console.log(JSON.stringify(t.others?{sites:i,others:a}:i,null,2));if(a.length&&(console.log(S.dim("not deployed by landfall, routed by Traefik (`lf adopt <name>` manages a Compose project):")),N([[S.dim(`NAME`),S.dim(`DOMAINS`),S.dim(`FOLDER`),S.dim(`STATUS`)],...a.map(e=>[e.name,e.domains.join(`, `),e.dir??S.dim(e.containers.join(`, `)),ei(e.status)])]),i.length&&console.log()),!i.length)return console.log(`no landfall sites on ${n} yet — ${S.bold(`lf deploy --domain example.com`)}`);N([[S.dim(`NAME`),S.dim(`KIND`),S.dim(`DOMAINS`),S.dim(`SERVICES`),S.dim(`RELEASE`),S.dim(`UPDATED`),S.dim(`STATUS`)],...i.map(({meta:e,status:t,services:n,kind:r,domains:i})=>[S.bold(e.name),r,i.join(`, `),n.map(e=>e.service).join(`, `)||S.dim(`-`),e.current||S.dim(`-`),P(e.updatedAt),ei(t)])])}}),ni=F({name:`sites info`,args:`[name]`,summary:`Show a site's services, domains and release history.`,options:{server:I},async run([e],t){let{site:n,server:r}=$r(e,t.server),i=(await Fn(r)).sites.find(e=>e.meta.name===n);i||O(`no site "${n}" on ${r.host}. See \`lf sites list\``);let a=i.meta;console.log(`${S.bold(a.name)} ${i.kind} ${ei(i.status)}`);for(let e of i.domains)console.log(` ${S.cyan(`https://`+e)}`);if(console.log(S.dim(` ${a.adopted??$(n)+`/current`} (docker compose works there)`)),i.services.length&&(console.log(`\n${S.bold(`Services`)}`),N(i.services.map(e=>[` ${e.service}`,S.dim(e.container),ei(e.status)]))),a.releases.length&&i.state!==`old`){console.log(`\n${S.bold(`Releases`)}`);for(let e of An(a)){let t=e.id===a.current?S.green(`● `):` `,n=e.services.filter(e=>e.port||e.own).map(e=>`${e.name}${e.port?`:`+e.port:``}`);console.log(`${t}${e.id} ${S.dim(P(e.at))} ${S.dim(e.services.map(e=>e.name).join(`, `))}${n.length?S.dim(` → ${n.join(`, `)}`):``}`)}}}}),ri=F({name:`logs`,args:`[name] [service]`,summary:`Show a site's logs: all its services, or one.`,options:{server:I,...qr},async run([e,t],n){let{site:r,server:i}=$r(e,n.server);return Kn(i,r,{...n,service:t})}}),ii=(e,t,n,r,i)=>F({name:e,args:`[name] [service]`,summary:`${e[0].toUpperCase()+e.slice(1)} a site's services, or one of them.`,options:{server:I},async run([a,o],s){let{site:c,server:l}=$r(a,s.server);await kn(l,c);let u=o?` ${L(o)}`:``,d=`record ${L(`${e} ${c}${o?` `+o:``}`)}`,f=`[ -n "$(cd -P current && dc ps -q --status running${u} 2>/dev/null)" ]`,p=r?`if ${i?``:`! `}${f}; then ${d} ${L(`cd -P ${$(c)}/current && dc ${r}${u}`)}; else ${d}; fi`:d;await Gn(l,c,t+u,p),w(`${o?`${c} ${o}`:c} ${n}`)}}),ai=ii(`restart`,`restart`,`restarted`),oi=ii(`stop`,`stop`,`stopped`,`start`,!0),si=ii(`start`,`up -d --wait`,`started`,`stop`,!1),ci=F({name:`rollback`,args:`[name]`,summary:`Switch a site back to the previous release (or --to <release>).`,options:{server:I,to:{type:`string`,desc:"release id (see `lf sites info`)"}},async run([e],t){let{site:n,server:r}=$r(e,t.server),{meta:i,proxy:a}=await kn(r,n,{deployed:`roll back`}),o=An(i),s=o.findIndex(e=>e.id===i.current);s<0&&!t.to&&O(`current release ${i.current} is not in the release list; pick one with --to (see \`lf sites info\`)`);let c=t.to?o.find(e=>e.id===t.to):o[s+1];c||O(t.to?`no release ${t.to}`:`no release older than ${i.current}`);let l=structuredClone(i);i.current=c.id,i.updatedAt=(/* @__PURE__ */ new Date()).toISOString(),await Wn(r,i,a,{keep:i.releases.length,prev:l,what:`rollback ${n} from ${l.current} to ${c.id}`}),w(`${n} rolled back to ${S.bold(c.id)}`)}}),li=F({name:`adopt`,args:`<project>`,summary:"Make a Compose project landfall did not deploy a site: `lf sites`, logs, restart,\nstop and start then work for it. It keeps running from its folder, with its own files and\nTraefik labels; landfall does not deploy, roll back or change its domains. `lf sites rm`\nstops it and forgets it again. The projects you can adopt are listed under `lf sites`.",options:{server:I,name:{type:`string`,desc:`site name (default: the project name)`}},async run([e],t){e||O("usage: lf adopt <project> (see the projects not deployed by landfall in `lf sites`)");let{server:n,name:r}=X(t.server),i=await Fn(n),a=i.others.find(t=>t.name===e);if(!a){let t=i.sites.find(t=>Gt(t.meta)===e);O(t?`${e} is already the site ${t.meta.name}`:`no Compose project "${e}" with Traefik routes on ${r}. See \`lf sites\``)}let o=a;o.dir||O(`${e} is a single container, not a Compose project: only Compose projects can be adopted`);let s=En(t.name??yn(e));i.sites.some(e=>e.meta.name===s)&&O(`there is a site "${s}" already: pick another name with --name`);let c=new Set([...rn,...an].map(e=>`${o.dir}/${e}`)),l=(o.files??``).split(`,`).filter(e=>e&&!c.has(e));l.length&&O(`${e} was started with ${l.join(`, `)}; rename it to compose.yaml in ${o.dir} (or adopt it after moving it there)`);let u=(/* @__PURE__ */ new Date()).toISOString();await Ln(n,{v:2,name:s,kind:`compose`,domains:o.domains,current:``,releases:[],adopted:o.dir,project:e,createdAt:u,updatedAt:u}),w(`adopted ${e} as ${s} (${o.domains.join(`, `)})`),console.log(S.dim(`it runs from ${o.dir} as before; lf logs ${s}, lf restart ${s} and lf sites rm ${s} now work`))}}),ui=F({name:`sites rm`,args:`<name>`,summary:`Stop a site and delete its files and releases from the server.
|
|
630
|
+
|
|
631
|
+
Named volumes (databases, uploads) stay, so deploying the site again finds its data;
|
|
632
|
+
--volumes deletes them too. An adopted site is stopped and forgotten; its folder stays.`,options:{server:I,volumes:{type:`boolean`,desc:`also delete the site's named volumes (its data)`}},async run([e],t){e||O(`usage: lf sites rm <name>`);let{site:n,server:r,name:i}=$r(e,t.server),{meta:a}=await On(r,n);a||O(`no site "${n}" on ${i}. See \`lf sites list\``);let o=a,s=Q(o).join(`, `)||`no domains`,c=t.volumes?` and its volumes (all its data)`:``;await j(o.adopted?`Stop ${n} (${s}) on ${i} and forget it${c}? ${o.adopted} stays.`:`Delete ${n} (${s})${c} from ${i}? This cannot be undone.`,n),await Jn(r,o,{volumes:t.volumes}),w(`removed ${n}${t.volumes?` and its volumes`:S.dim(` (its volumes stay; --volumes deletes them)`)}`)}}),di=F({name:`env`,args:`[name] [KEY=VALUE...]`,summary:`Show or change a site's .env; services whose environment changed are recreated.`,options:{server:I,unset:{type:`string`,short:`u`,multiple:!0,desc:`remove KEY`}},async run(e,t){let n=e.filter(e=>e.includes(`=`)),[r]=e.filter(e=>!e.includes(`=`)),{site:i,server:a}=$r(r,t.server),{env:o}=await kn(a,i,{deployed:`manage the .env of`});if(!n.length&&!t.unset?.length)return void process.stdout.write(o||S.dim(`(empty)
|
|
633
|
+
`));let s=Yn(o,Xn(n),t.unset??[]),c=[...n.map(e=>e.slice(0,e.indexOf(`=`))),...(t.unset??[]).map(e=>`-${e}`)];await Gn(a,i,`up -d --wait --quiet-pull`,`u=$(saved .env)
|
|
634
|
+
record ${L(`env ${i} ${c.join(` `)}`)} "cd ${$(i)} && $u && cd -P current && dc up -d"
|
|
635
|
+
${z(`.env`,s,`600`)}`),w(`updated env of ${i}`)}});async function fi(e){try{return{status:(await fetch(`https://${e}`,{method:`HEAD`,signal:AbortSignal.timeout(8e3),redirect:`manual`})).status}}catch(e){return{error:e?.cause?.code??e?.code??e?.message??String(e)}}}async function pi(e,t,n,r,i,a){let o=await Fn(e);for(let e of o.others){let t=e.domains.filter(e=>r.includes(e));t.length&&E(`${t.join(`, `)} ${t.length>1?`are`:`is`} also routed to ${e.name}${e.dir?` (${e.dir})`:``}, which landfall did not deploy: Traefik sends visitors to only one of them. Remove the labels there to hand ${t.length>1?`them`:`it`} over.`)}let s=o.sites.map(e=>e.meta).filter(e=>e.name!==n&&Q(e).some(e=>r.includes(e)));for(let e of s){let t=Q(e).filter(e=>r.includes(e)),i=Xt(e)?t.filter(t=>!e.domains.includes(t)):t;if(i.length){let t=Wt(e)?`redeploy it first (lf deploy) so it can hand them over`:e.adopted?`its compose files in ${e.adopted} route ${i.length>1?`them`:`it`}`:`its compose.yaml routes ${i.length>1?`them`:`it`} (x-landfall.domains)`;O(`${i.join(`, `)} ${i.length>1?`serve`:`serves`} ${e.name} now and cannot move from there: ${t}`)}a&&O(`${t.join(`, `)} ${t.length>1?`serve`:`serves`} ${e.name} now; ${a}`),t.length===e.domains.length&&O(`${t.join(`, `)} ${t.length>1?`are`:`is`} all ${e.name} serves: give it another domain first (lf domains ${e.name} --add <domain>) or remove it (lf sites rm ${e.name})`),await j(`${t.join(`, `)} ${t.length>1?`serve`:`serves`} ${e.name} now. Move ${t.length>1?`them`:`it`} to ${n}?`)}return async()=>{for(let a of s){let o=structuredClone(a);a.domains=a.domains.filter(e=>!r.includes(e)),a.updatedAt=(/* @__PURE__ */ new Date()).toISOString(),await Wn(e,a,i,{keep:a.releases.length,prev:o,what:`moved ${o.domains.filter(e=>r.includes(e)).join(`, `)} from ${a.name} to ${n}`}),Tn(t,a.name,a.domains),T(S.dim(`${a.name} keeps ${a.domains.join(`, `)}`))}}}const mi=F({name:`domains`,args:`[site]`,summary:`Show a site's domains with their DNS and HTTPS state, or change them.
|
|
549
636
|
|
|
550
637
|
Without flags it lists and checks; --add/--rm/--set change the site (undoable)
|
|
551
|
-
and update
|
|
638
|
+
and update .landfall.json of remembered projects.`,options:{server:I,add:{type:`string`,short:`a`,multiple:!0,desc:"add a domain (`blog` = blog.<main domain>, `@` = the main domain); another site's moves here"},rm:{type:`string`,multiple:!0,desc:`remove a domain`},set:{type:`string`,multiple:!0,desc:`replace all domains`},json:{type:`boolean`,desc:`machine-readable output (listing)`}},async run([e],t){let{site:n,name:r,server:i}=$r(e,t.server),a=!!(t.add||t.rm||t.set),{meta:o,proxy:s}=await kn(i,n,a?{deployed:`change the domains of`}:{});if(!a){let e=Q(o),r=await Rt(i),[a,s]=await Promise.all([Vt(e,r),Promise.all(e.map(fi))]),c=a.map((e,t)=>({...e,https:s[t]}));if(t.json)return void console.log(JSON.stringify({site:n,serverIps:r,domains:c},null,2));for(let e of c){let t=e.ok?S.green(`dns ok`):e.ips.length?S.yellow(`dns → ${e.ips.join(`, `)}`):S.red(`no dns`),n=e.https.status?(e.https.status<400?S.green:e.https.status===401?S.cyan:S.yellow)(`https ${e.https.status}`):S.red(`https ${e.https.error}`);console.log(`${S.cyan(`https://${e.domain}`)} ${t} ${n}`)}c.some(e=>!e.ok)&&console.log(S.dim(`\npoint an A record at ${r.join(` or `)} for each domain`));return}Xt(o)||O(`no service of ${n} serves the site's domains: its compose.yaml sets them (x-landfall.domains)`);let c=e=>(e??[]).map(e=>ct(e.trim(),i)).filter(Boolean),l=t.set?c(t.set):[...o.domains];l=[.../* @__PURE__ */ new Set([...l,...c(t.add)])].filter(e=>!c(t.rm).includes(e));let u=l.filter(e=>!tt.test(e));u.length&&O(`not a domain: ${u.join(`, `)}`),l.length||O(`a site needs at least one domain`);let d=c(t.rm).filter(e=>!o.domains.includes(e));if(d.length&&E(`${d.join(`, `)} not on ${n}`),l.join()===o.domains.join())return w(`nothing to change`);let f=o.domains.filter(e=>!l.includes(e));f.length&&await j(`Remove ${f.join(`, `)} from ${n}? ${f.length>1?`They stop`:`It stops`} serving it.`);let p=await pi(i,r,n,l.filter(e=>!o.domains.includes(e)),s),m=structuredClone(o);o.domains=l,o.updatedAt=(/* @__PURE__ */ new Date()).toISOString(),await p(),await Wn(i,o,s,{keep:o.releases.length,prev:m,what:`domains of ${n}: ${l.join(`, `)}`}),Tn(r,n,l);let h=mt(process.cwd());h?.name===n&&ht(process.cwd(),{...h,domains:l}),w(`${n} serves ${l.map(e=>S.cyan(`https://${e}`)).join(`, `)}`);let ee=await Rt(i);for(let e of await Vt(l.filter(e=>!m.domains.includes(e)),ee))e.ok||E(`${e.domain} ${e.ips.length?`points at ${e.ips.join(`, `)}`:`has no DNS record`}, not ${ee.join(` or `)}: HTTPS waits for it`)}}),hi=F({name:`auth`,args:`[site]`,summary:`Protect a site with a password (HTTP basic auth in Traefik).
|
|
552
639
|
|
|
553
640
|
lf auth my-site --user anna add or change a login (asks the password)
|
|
554
641
|
lf auth my-site --rm-user anna remove a login
|
|
555
642
|
lf auth my-site --off remove all logins: the site is public again
|
|
556
|
-
lf auth my-site show who can log in`,options:{server:
|
|
643
|
+
lf auth my-site show who can log in`,options:{server:I,user:{type:`string`,short:`u`,desc:`login to add or change`},password:{type:`string`,short:`p`,desc:`its password (asked when missing)`},"rm-user":{type:`string`,multiple:!0,desc:`remove a login`},off:{type:`boolean`,desc:`remove every login`}},async run([e],t){let{site:n,server:r}=$r(e,t.server),{meta:i,proxy:a}=await kn(r,n,{deployed:`set logins for`}),o=(i.auth??[]).map(e=>e.slice(0,e.indexOf(`:`)));if(!t.user&&!t[`rm-user`]&&!t.off){if(!o.length)return void console.log(`${n} is public ${S.dim(`(add a login with --user)`)}`);console.log(`${n} asks for a login: ${o.map(e=>S.bold(e)).join(`, `)}`);return}let s=t.off?[]:[...i.auth??[]],c=new Set(t[`rm-user`]??[]);for(let e of c)o.includes(e)||E(`no login ${e} on ${n}`);if(t.user){/^[A-Za-z0-9._@-]{1,64}$/.test(t.user)||O(`user may only have letters, digits and . _ @ -`);let e=t.password??await ie(`Password for ${t.user}:`);e.length<8&&O(`use a password of at least 8 characters`),c.add(t.user),s=s.filter(e=>!c.has(e.slice(0,e.indexOf(`:`)))),s.push(await Hr(t.user,e))}else s=s.filter(e=>!c.has(e.slice(0,e.indexOf(`:`))));if(s.join(`
|
|
557
644
|
`)===(i.auth??[]).join(`
|
|
558
|
-
`))return
|
|
645
|
+
`))return w(`nothing to change`);let l=s.map(e=>e.slice(0,e.indexOf(`:`))),u=o.filter(e=>!l.includes(e));l.length?u.length&&await j(`Remove the login${u.length>1?`s`:``} ${u.join(`, `)} from ${n}?`):await j(`Remove every login from ${n}? Anyone can open it then.`);let d=structuredClone(i);i.auth=s.length?s:void 0,i.updatedAt=(/* @__PURE__ */ new Date()).toISOString(),await Wn(r,i,a,{keep:i.releases.length,prev:d,what:l.length?`login for ${n}: ${l.join(`, `)}`:`removed the login of ${n}`}),w(l.length?`${n} asks for a login (${l.join(`, `)})`:`${n} is public again`)}}),gi=F({name:`open`,args:`[site]`,summary:`Open a site in the browser.`,options:{server:I},async run([e],t){let{site:n,server:r}=$r(e,t.server),{meta:i}=await kn(r,n),a=Q(i)[0];a||O(`${n} serves no domain`);let o=`https://${a}`;console.log(S.cyan(o)),ae(o)}}),_i=(e=/* @__PURE__ */ new Date)=>e.toISOString().replace(/[-:T]/g,``).slice(0,14);function vi(e,t=/* @__PURE__ */ new Date){let n=t.getTime();for(;e.includes(_i(new Date(n)));)n+=1e3;return _i(new Date(n))}const yi=F({name:`deploy`,args:`[dir]`,summary:`Deploy a Compose project, static folder, Dockerfile or image with HTTPS.
|
|
559
646
|
|
|
560
647
|
Kinds:
|
|
561
|
-
|
|
648
|
+
compose the folder has a compose.yaml: its services run on the server as one
|
|
649
|
+
project; x-landfall: { port: 3000 } on a service routes it through Traefik
|
|
562
650
|
dockerfile the folder has a Dockerfile: uploaded and built on the server
|
|
651
|
+
static a folder of files (auto-detects dist/, build/, out/, public/)
|
|
563
652
|
image --image: run a prebuilt image (e.g. ghcr.io/me/app:1.2)
|
|
564
653
|
|
|
565
|
-
|
|
566
|
-
|
|
567
|
-
|
|
568
|
-
|
|
569
|
-
`)
|
|
654
|
+
Every site is a Compose project on the server (/opt/landfall/sites/<name>/current),
|
|
655
|
+
so \`docker compose\` works there without landfall. Settings are saved to
|
|
656
|
+
./.landfall.json, so later deploys are just \`lf deploy\`.`,options:{server:I,name:{type:`string`,short:`n`,desc:`site name (default: folder name)`},domain:{type:`string`,short:`d`,multiple:!0,desc:"domain to serve (`blog` = blog.<main domain>, `@` = the main domain); another site's moves here"},file:{type:`string`,short:`f`,desc:`compose file to deploy (default: compose.yaml)`},spa:{type:`boolean`,desc:`single-page app: unknown paths serve index.html`},image:{type:`string`,desc:`deploy a docker image instead of files`},port:{type:`string`,desc:`container port (image/dockerfile; default: EXPOSE or 3000)`},static:{type:`boolean`,desc:`force static even if a Dockerfile or compose file exists`},env:{type:`string`,short:`e`,multiple:!0,desc:`set KEY=VALUE in the site's .env`},"env-file":{type:`string`,desc:`merge a local .env file into the site's .env`},build:{type:`string`,short:`b`,desc:`run this command locally first (e.g. 'npm run build')`},keep:{type:`string`,desc:`releases to keep for rollback`,default:`5`},save:{type:`boolean`,desc:`write .landfall.json (--no-save to skip)`,default:!0}},async run([e],t){let n=process.cwd(),i=mt(n)??{};i.name&&T(S.dim(`using ${ft}`));let{name:a,server:s}=X(t.server??i.server),c=En(t.name??i.name??yn(d(n))),l=at(t.keep,`--keep`,1),u=t.build??i.build;if(u){C(`building locally: ${u}`);let e=r(u,{shell:!0,stdio:`inherit`});e.status!==0&&O(`build failed (exit ${e.status})`)}let f=t.static??i.static,ee=t.image??(f?void 0:i.image),g=ee&&it(ee),_=h(n,e??i.dir??`.`),v=g||f?void 0:t.file??bn(_,i);v&&!o.existsSync(p(_,v))&&O(`no ${v} in ${m(n,_)||`.`}`);let y=v||g?_:h(n,e??i.dir??_n(n)),b=v?`compose`:g?`image`:!f&&o.existsSync(p(y,`Dockerfile`))?`dockerfile`:`static`;b===`static`&&!o.existsSync(p(y,`index.html`))&&E(`no index.html in ${m(n,y)||`.`}`);let x=b===`dockerfile`||b===`image`?at(t.port??i.port??(b===`dockerfile`?vn(p(y,`Dockerfile`)):void 0)??3e3,`--port`,1,65535):void 0,D=b===`static`&&!!(t.spa??i.spa);C(`deploying ${S.bold(c)} (${b}) to ${S.bold(a)}`);let k=await On(s,c),{env:A,proxy:te,exists:re}=k,j=k.meta&&Wt(k.meta)?k.meta:void 0,M=j?void 0:k.meta;M?.adopted&&O(`${c} is adopted (${M.adopted}): deploy it there with docker compose, or pick another --name`),j?E(`${c} was deployed by an older landfall: this moves it to a Compose project (its old releases go, so it cannot be undone)`):M&&M.kind!==b&&T(S.dim(`site was ${M.kind}, now ${b}`));let N;(t.env?.length||t[`env-file`])&&(N=A,t[`env-file`]&&(N=Yn(N,Xn(bi(o.readFileSync(t[`env-file`],`utf8`))))),t.env?.length&&(N=Yn(N,Xn(t.env))));let P=vi((M?.releases??[]).map(e=>e.id)),ie=`${$(c)}/releases/${P}`,ae={};b===`static`&&Object.assign(ae,{"compose.yaml":mn(`static`),"nginx.conf":hn(D)}),(b===`dockerfile`||b===`image`)&&(ae[`compose.yaml`]=mn(b,{port:x,image:g}));let F,I,oe;try{b!==`image`&&(C(`uploading ${m(n,y)||`.`}`),await Ee(s,y,b===`static`?`${ie}/public`:ie));let e=await In(s,c,P,{file:v,generated:ae,env:N}),r=cn(e.config,e.dir,e=>ct(e,s));for(let e of r.warnings)E(e);r.errors.length&&O(`${v??`compose.yaml`} cannot be deployed:\n${r.errors.map(e=>` - ${e}`).join(`
|
|
657
|
+
`)}`),F={id:P,at:(/* @__PURE__ */ new Date()).toISOString(),services:r.services};let o=r.services.flatMap(e=>e.domains??[]);I=[];let l=!1;if(Yt(F)){if(l=!t.domain?.length&&!!i.domains?.length,I=[t.domain,i.domains,M?.domains,j?.domains].find(e=>e?.length)??[],!I.length){let e=st(s),t=e?void 0:zt(await Rt(s));I=(await ne(`Domain(s) to serve (comma separated):`,e?`${c}.${e}`:t?Bt(c,t):void 0)).split(/[\s,]+/).filter(Boolean)}I=[...new Set(I.map(e=>ct(e,s)))];let e=I.filter(e=>!tt.test(e)),n=I.filter(e=>o.includes(e));I.length||O(`at least one --domain is required`),e.length&&O(`not a domain: ${e.join(`, `)}`),n.length&&O(`${n.join(`, `)} is already routed by x-landfall.domains`)}else t.domain?.length&&E(`-d ignored: every routed service of ${c} names its own x-landfall.domains`);oe=await pi(s,a,c,[...I,...o],te,l?`${ft} lists it; deploy with -d to move it`:void 0)}catch(e){throw await Rn(s,c,P).catch(()=>{}),e}let se=(/* @__PURE__ */ new Date()).toISOString(),ce={v:2,name:c,kind:b,domains:I,auth:M?.auth??j?.auth,current:P,releases:[...M?.releases??[],F],createdAt:M?.createdAt??j?.createdAt??se,updatedAt:se};await oe(),await Wn(s,ce,te,{env:N,build:!0,pull:!0,keep:l,prev:M,takeover:j,existed:!M&&!j&&re,what:`deploy ${c} release ${P}${M?``:` (new site, ${Q(ce).join(`, `)})`}`});let le=Q(ce);if(t.save){let e={name:c,server:a,domains:I};if(b===`image`)Object.assign(e,{image:g,port:x});else{let r=m(n,y)||`.`;b===`compose`?(r!==`.`&&(e.dir=r),(t.file||i.compose)&&(e.compose=v)):r!==_n(n)&&(e.dir=r),b===`dockerfile`&&(e.port=x),D&&(e.spa=!0),f&&b===`static`&&(e.static=!0)}u&&(e.build=u),ht(n,e),wn({path:n,name:c,server:a,domains:le,kind:b})}w(`release ${S.bold(P)} live`);for(let e of le)console.log(` ${S.cyan(`https://${e}`)}`);le[0]&&await xi(le[0])}});function bi(e){return e.split(`
|
|
658
|
+
`).map(e=>e.trim().replace(/^export\s+/,``)).filter(e=>e&&!e.startsWith(`#`)&&e.includes(`=`))}async function xi(e){try{let t=await fetch(`https://${e}`,{signal:AbortSignal.timeout(15e3),redirect:`manual`});t.status<400?w(`https://${e} responded ${t.status}`):E(`https://${e} responded ${t.status}`)}catch(t){let n=t?.cause?.code??t?.code??t?.message??String(t);E(`could not reach https://${e} yet (${n}). DNS or the first certificate may still be pending.`)}}const Si=F({name:`init`,args:`[dir]`,summary:`Write a compose.yaml for this project, to run it locally and deploy it.
|
|
659
|
+
|
|
660
|
+
compose.yaml what runs on the server; x-landfall routes a service through Traefik
|
|
661
|
+
compose.override.yaml local only (docker compose merges it, lf deploy leaves it out):
|
|
662
|
+
publishes the port on localhost
|
|
663
|
+
|
|
664
|
+
\`docker compose up\` then runs the site locally, \`lf deploy\` on a server. Existing
|
|
665
|
+
files are never overwritten.`,options:{port:{type:`string`,desc:`container port (default: EXPOSE, the saved port or 3000)`},postgres:{type:`boolean`,desc:`add a Postgres service with a volume; the app gets DATABASE_URL`}},async run([e],t){let n=h(process.cwd(),e??`.`);o.statSync(n,{throwIfNoEntry:!1})?.isDirectory()||O(`${e} is not a folder`);let r=xn(n);r.kind===`compose`&&O(`${r.compose} exists already: add x-landfall: { port: <port> } to the service Traefik should serve`);let i={"compose.yaml":``,"compose.override.yaml":``},a=Object.keys(i).filter(e=>o.existsSync(p(n,e)));a.length&&O(`${a.join(` and `)} exist already`);let s=r.kind===`static`?80:at(t.port??r.port??3e3,`--port`,1,65535),c=r.kind===`static`?8080:s,l=!!t.postgres,u;if(r.kind===`static`){let e=r.dir??`dist`;r.dir||T(S.dim(`no built site found: serving ./${e}, change it in compose.yaml if your build writes elsewhere`)),u=` web:
|
|
666
|
+
image: nginx:alpine
|
|
667
|
+
restart: unless-stopped
|
|
668
|
+
volumes:
|
|
669
|
+
- ./${e}:/usr/share/nginx/html:ro
|
|
670
|
+
x-landfall:
|
|
671
|
+
port: 80
|
|
672
|
+
`}else u=` app:
|
|
673
|
+
${r.kind===`image`?`image: ${r.project.image}`:`build: .`}
|
|
674
|
+
restart: unless-stopped
|
|
675
|
+
env_file:
|
|
676
|
+
- path: .env
|
|
677
|
+
required: false
|
|
678
|
+
${l?` environment:
|
|
679
|
+
DATABASE_URL: postgres://app:\${POSTGRES_PASSWORD}@db:5432/app
|
|
680
|
+
depends_on:
|
|
681
|
+
db:
|
|
682
|
+
condition: service_healthy
|
|
683
|
+
`:``} x-landfall:
|
|
684
|
+
port: ${s}
|
|
685
|
+
`;let d=r.kind===`static`?`web`:`app`;i[`compose.yaml`]=`# Runs locally with \`docker compose up\` and on a server with \`lf deploy\`.
|
|
686
|
+
# x-landfall.port: the port Traefik sends the site's requests to (HTTPS on its domains).
|
|
687
|
+
services:
|
|
688
|
+
${u}${l?` db:
|
|
689
|
+
image: postgres:17-alpine
|
|
690
|
+
restart: unless-stopped
|
|
691
|
+
environment:
|
|
692
|
+
POSTGRES_USER: app
|
|
693
|
+
POSTGRES_DB: app
|
|
694
|
+
POSTGRES_PASSWORD: \${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
|
|
695
|
+
volumes:
|
|
696
|
+
- db:/var/lib/postgresql/data
|
|
697
|
+
healthcheck:
|
|
698
|
+
test: pg_isready -U app
|
|
699
|
+
interval: 5s
|
|
700
|
+
retries: 10
|
|
701
|
+
|
|
702
|
+
# Survives deploys and rollbacks; \`lf sites rm --volumes\` deletes it.
|
|
703
|
+
volumes:
|
|
704
|
+
db:
|
|
705
|
+
`:``}`,i[`compose.override.yaml`]=`# Local only: docker compose merges this file, lf deploy leaves it out.
|
|
706
|
+
services:
|
|
707
|
+
${d}:
|
|
708
|
+
ports:
|
|
709
|
+
- "127.0.0.1:${c}:${s}"
|
|
710
|
+
`;for(let[e,t]of Object.entries(i))o.writeFileSync(p(n,e),t);let f=m(process.cwd(),n)||`.`;w(`wrote compose.yaml and compose.override.yaml in ${f}`),l&&!o.existsSync(p(n,`.env`))&&T(`locally: put POSTGRES_PASSWORD=… in ${p(f,`.env`)} (keep it out of git)`),T(`run it: docker compose up${r.kind===`static`?``:` --build`} → http://localhost:${c}`),T(`deploy it: lf deploy${l?` -e POSTGRES_PASSWORD=<secret> (the first time)`:``}`)}}),Ci=async e=>{let t=``;for await(let n of e)t+=n;return t};let wi;function Ti(){if(wi)return wi;let e=o.mkdtempSync(p(l(),`landfall-`));return wi=p(e,`askpass`),o.writeFileSync(wi,`#!/bin/sh
|
|
711
|
+
printf '%s\\n' "$LANDFALL_PASSWORD"
|
|
712
|
+
`,{mode:448}),process.on(`exit`,()=>o.rmSync(e,{recursive:!0,force:!0})),wi}const Ei=e=>({SSH_ASKPASS:Ti(),SSH_ASKPASS_REQUIRE:`force`,LANDFALL_PASSWORD:e});async function Di(e){if(e){let e=(await Ci(process.stdin)).replace(/\r?\n$/,``);return e||O(`--password-stdin: nothing on stdin`),e}return Xe(`PASSWORD`)||void 0}const Oi=e=>{let t=p(s(),`.ssh`,`landfall_${e}`),n=Ge(e);return o.existsSync(t)||!o.existsSync(n)?t:n};function ki(e){let t=Oi(e);return o.existsSync(t)?{path:t,created:!1}:(o.mkdirSync(p(s(),`.ssh`),{recursive:!0,mode:448}),r(`ssh-keygen`,[`-q`,`-t`,`ed25519`,`-f`,t,`-N`,``,`-C`,`landfall-${e}`],{stdio:`inherit`}).status!==0&&O(`ssh-keygen failed`),{path:t,created:!0})}async function Ai(e,t,n){let i=Z(t),a=t.key?q(t.key):void 0;if(a&&!o.existsSync(a)&&O(`key not found: ${a}`),a&&!o.existsSync(`${a}.pub`)){let e=r(`ssh-keygen`,[`-y`,`-f`,a],{encoding:`utf8`});e.status!==0&&O(`cannot read ${a} (passphrase-protected keys need ssh-agent and a .pub next to it)`),o.writeFileSync(`${a}.pub`,e.stdout,{mode:420})}let s=await Se(t);if(!s&&!t.key&&o.existsSync(Oi(e))&&await Se({...t,key:Oi(e)})&&(t.key=a=Oi(e),s=!0),s)w(`key login works`),a??=vt(t);else if(n.check){E("no key login yet — `lf setup` would install a key first");return}let c=!1;if(!a&&!n.check){let t=ki(e);a=t.path,c=t.created,c&&w(`generated key ${J(a)}`)}let l=t.key&&q(t.key);if(t.key=a,!n.check&&!(s&&l===a)&&(c||!await Se(t))){C(`installing key on ${i.hostname} (${n.password?`with the given password`:`enter the ${i.user} password once`})`);let e=n.password?{...process.env,...Ei(n.password)}:process.env;r(`ssh-copy-id`,[`-f`,...me(t),pe(t)],{stdio:n.password?[`ignore`,`inherit`,`inherit`]:`inherit`,env:e}).status===0&&await Se(t)||O(`could not log in with the key — check host, user and password`),w(`key installed`)}return a}const ji=e=>{for(let t of e)console.log(S.dim(` `)+t)};function Mi(e,t,n,r){let i=Z(t),a={...r.existing,host:t.host};if(r.sshConfig&&!r.ownAlias){let r=Tt({alias:e,hostname:i.hostname,user:t.user??i.user,port:i.port,key:n});w(`${r.created?`created`:`updated`} ${J(gt)} with ${S.bold(`Host ${e}`)} — try \`ssh ${e}\``),ji(r.block.split(`
|
|
713
|
+
`)),a.host=e,delete a.user,delete a.port,delete a.key}else{t.user&&(a.user=t.user),r.port&&(a.port=Number(r.port));let o=r.keyGiven||n!==vt({host:t.host}),s=o&&r.ownAlias&&r.sshConfig?Dt(e,n):void 0;s?(w(`added the key to your ${S.bold(`Host ${e}`)} in ${J(s.file)} ${S.dim(`(backup: ${J(s.backup)})`)}`),ji([...s.removed.map(e=>S.red(`- ${e}`)),S.green(`+ ${s.added}`)]),delete a.key):o&&(a.key=J(n)),r.ownAlias&&T(S.dim(`kept your own ~/.ssh/config entry for ${e}; lf logs in as ${a.user??i.user}`))}return a}const Ni=F({name:`server add`,args:`<name>`,summary:`Register a server without setting it up (fresh or not).
|
|
570
714
|
|
|
571
715
|
Without --host, <name> is used as an ssh alias from ~/.ssh/config,
|
|
572
|
-
so \`lf server add
|
|
716
|
+
so \`lf server add vps\` works whenever \`ssh vps\` works.
|
|
573
717
|
|
|
574
718
|
With --host lf logs in with --key, or installs its own key
|
|
575
|
-
(~/.ssh/
|
|
719
|
+
(~/.ssh/landfall_<name>) using the password once, and writes \`Host <name>\`
|
|
576
720
|
to ~/.ssh/config (created if missing), so \`ssh <name>\` works afterwards.
|
|
577
|
-
The password comes from the prompt, --password-stdin or $
|
|
578
|
-
Any ~/.ssh/config alias works too (--all to list them).`)))}}),
|
|
579
|
-
`)}:null}}}const
|
|
721
|
+
The password comes from the prompt, --password-stdin or $LANDFALL_PASSWORD.`,options:{host:{type:`string`,desc:`hostname or IP (default: <name> as ssh alias)`},user:{type:`string`,short:`u`,desc:`login user (default: root for --host, else ssh config)`},port:{type:`string`,short:`p`,desc:`ssh port (default: from ssh config)`},key:{type:`string`,short:`i`,desc:`private key file to log in with`},"password-stdin":{type:`boolean`,desc:`read the login password from stdin (installs landfall's key)`},"ssh-config":{type:`boolean`,desc:`write Host <name> to ~/.ssh/config (--no-ssh-config)`,default:!0},email:{type:`string`,desc:`contact e-mail for the Let's Encrypt account (optional)`},domain:{type:`string`,desc:`main domain: sites default to <site>.<domain>`},default:{type:`boolean`,desc:`make it the default server`}},async run([e],t){e||O(`usage: lf server add <name> [--host ...]`);let n=t.domain&&nt(t.domain),r=Y(),i=r.servers[e],a=yt().includes(e)&&!kt(e);t.host&&a&&O(`${e} is already a Host in your ssh config; pick another name or drop --host`);let o={host:t.host??i?.host??e,user:t.user??(t.host?`root`:i?.user),port:t.port?Number(t.port):i?.port,key:t.key??i?.key},s=await Di(t[`password-stdin`]),c=await Ai(e,o,{check:!s&&!te(),password:s}),l=c?Mi(e,o,c,{existing:i,sshConfig:t[`ssh-config`],ownAlias:a,port:t.port,keyGiven:!!t.key}):{...i,...o};l.key||delete l.key,l.user||delete l.user,l.port||delete l.port,t.email&&(l.email=t.email),n&&(l.domains=ot(l.domains,n)),r.servers[e]=l,(t.default||!r.default)&&(r.default=e),et(r),w(`added ${S.bold(e)}${r.default===e?S.dim(` (default)`):``}`),T(c?S.dim(`next: lf setup ${e} --check shows what setup would install`):`then: ${S.bold(`lf setup ${e}`)} (asks for the password and installs a key)`)}}),Pi=F({name:`server list`,summary:`List servers registered with landfall and aliases found in ~/.ssh/config.`,options:{all:{type:`boolean`,short:`a`,desc:`also list every ssh config alias`}},async run(e,t){let n=Y(),r=[[S.dim(`NAME`),S.dim(`TARGET`),S.dim(`SOURCE`)]];for(let[e,t]of Object.entries(n.servers)){let i=`${t.user?t.user+`@`:``}${t.host}${t.port?`:`+t.port:``}`;r.push([e+(n.default===e?S.green(` *`):``),i,`landfall`])}if(t.all)for(let e of yt())n.servers[e]||r.push([e,e,kt(e)?`ssh (landfall)`:`ssh`]);r.length===1?console.log(`no servers yet — ${S.bold(`lf server add <ssh-alias>`)} or ${S.bold(`lf setup <name> --host <ip>`)}`):(N(r),t.all||console.log(S.dim(`
|
|
722
|
+
Any ~/.ssh/config alias works too (--all to list them).`)))}}),Fi=F({name:`server rm`,args:`<name>`,summary:`Forget a server (nothing is changed on the server itself).`,options:{"ssh-config":{type:`boolean`,desc:`also remove the landfall-managed Host block from ~/.ssh/config`}},async run([e],t){e||O(`usage: lf server rm <name>`);let n=Y();!n.servers[e]&&!kt(e)&&O(`unknown server "${e}"`),await j(`Forget server ${e}? Nothing on the server changes.`),delete n.servers[e],n.default===e&&delete n.default,et(n),t[`ssh-config`]&&Ot(e)&&w(`removed Host ${e} from ~/.ssh/config`),w(`removed ${e}`)}}),Ii=F({name:`server use`,args:`<name>`,summary:`Set the default server used when --server is omitted.`,async run([e]){e||O(`usage: lf server use <name>`);let t=Y();t.servers[e]??={host:e},t.default=e,et(t),w(`default server: ${S.bold(e)}`)}}),Li=F({name:`ssh`,args:`[name] [-- command...]`,summary:`Open a shell on a server, or run a command there.`,passthrough:!0,async run([e],t,n){let{server:r}=X(e);return be(r,n)}}),Ri=F({name:`server info`,args:`[name]`,summary:`Show OS, hardware, load, memory, disk, addresses and containers of a server.`,options:{json:{type:`boolean`,desc:`machine-readable output`}},async run([e],t){let{name:n,server:r}=X(e),i=await Nt(r);if(t.json)return void console.log(JSON.stringify({name:n,...i,ips:await Rt(r,i)},null,2));let a=(e,t)=>t?` (${Math.round(e/t*100)}%)`:``,o=i.mem.total-i.mem.available;console.log(S.bold(n)+S.dim(` (${r.host})`));let s=[[`os`,`${i.os}${i.pkg===`none`?``:S.dim(` · ${i.pkg}`)}`],[`kernel`,`${i.kernel} ${i.arch}`],[`uptime`,`${Ut(i.uptime)}${i.reboot?S.yellow(` · reboot required`):``}`],[`cpu`,`${i.cpus} cores, load ${i.load}`],[`memory`,`${Ht(o)} / ${Ht(i.mem.total)}${a(o,i.mem.total)}`],[`disk`,`${Ht(i.disk.used)} / ${Ht(i.disk.total)}${a(i.disk.used,i.disk.total)}`],[`address`,[i.ip4,i.ip6].filter(Boolean).join(`, `)||`unknown`],[`docker`,i.docker||`not installed or no access (run lf setup)`]];for(let[e,t]of s)console.log(`${S.dim(e.padEnd(8))} ${t}`);i.support.note&&(i.support.level===`ok`?console.log:E)(i.support.note),i.docker&&(console.log(),await R(r,`docker ps --format 'table {{.Names}}\\t{{.Image}}\\t{{.Status}}' 2>/dev/null || true`))}});function zi(e){let t=Y(),n=t.servers[e],r=n??{host:e},i=Z(r),a=Et(r.host),s=Ur(r,{});return{name:e,isDefault:t.default===e,configFile:J($e),saved:n?{...n,dashboard:n.dashboard&&{host:n.dashboard.host,user:n.dashboard.user}}:null,domains:r.domains??[],traefik:{...s,summary:Wr(s),dashboard:r.dashboard?.host??null},ssh:{hostname:i.hostname,user:i.user,port:i.port,keys:(r.key?[r.key]:i.identityFiles).map(e=>({file:J(e),exists:o.existsSync(q(e))})),block:a?{file:J(a.file),line:a.start+1,managed:a.managed,text:a.lines.join(`
|
|
723
|
+
`)}:null}}}const Bi=F({name:`server config`,args:`[name]`,summary:`Show every setting landfall uses for a server: its entry in landfall's config,
|
|
580
724
|
the main domain, Traefik settings, what ssh resolves (host, user, port, keys)
|
|
581
|
-
and the Host block in ~/.ssh/config. Nothing connects to the server.`,options:{json:{type:`boolean`,desc:`machine-readable output`}},async run([e],t){let{name:n}=
|
|
582
|
-
`))console.log(` ${e}`)}else console.log(`\n${
|
|
725
|
+
and the Host block in ~/.ssh/config. Nothing connects to the server.`,options:{json:{type:`boolean`,desc:`machine-readable output`}},async run([e],t){let{name:n}=X(e),r=zi(n);if(t.json)return void console.log(JSON.stringify(r,null,2));let i=(e,t)=>console.log(` ${S.dim(e.padEnd(10))} ${t}`);if(console.log(`${S.bold(n)}${r.isDefault?S.dim(` (default)`):``}`),console.log(`\n${S.bold(`landfall`)} ${S.dim(r.configFile)}`),!r.saved)i(`entry`,S.dim(`none — an ssh alias landfall was not told about (lf server add)`));else for(let[e,t]of Object.entries(r.saved))t!==void 0&&e!==`dashboard`&&e!==`domains`&&i(e,String(t));r.domains.length||i(`domain`,S.dim(`none (lf server domain ${n} example.com)`)),r.domains.forEach((e,t)=>i(t?``:r.domains.length>1?`domains`:`domain`,t?e:`${e} ${S.dim(`(primary: new sites get <site>.${e})`)}`)),i(`traefik`,`${r.traefik.summary}${r.traefik.email?`, ${r.traefik.email}`:``} ${S.dim(`(when landfall installs it)`)}`),i(`dashboard`,r.traefik.dashboard?`https://${r.traefik.dashboard}`:S.dim(`off`)),console.log(`\n${S.bold(`ssh`)} ${S.dim(`ssh -G ${r.saved?.host??n}`)}`),i(`login`,`${r.ssh.user}@${r.ssh.hostname}:${r.ssh.port}`);for(let e of r.ssh.keys)i(`key`,e.exists?e.file:`${e.file} ${S.dim(`(missing)`)}`);if(r.ssh.block){console.log(`\n${S.bold(`ssh config`)} ${S.dim(`${r.ssh.block.file}:${r.ssh.block.line}${r.ssh.block.managed?`, written by landfall`:`, your own`}`)}`);for(let e of r.ssh.block.text.split(`
|
|
726
|
+
`))console.log(` ${e}`)}else console.log(`\n${S.bold(`ssh config`)} ${S.dim(`no Host block; ssh uses its defaults`)}`)}});async function Vi(e,t){let n=await Rt(e),[r,i]=await Vt([t,`landfall-${v(4).toString(`hex`)}.${t}`],n);return{ips:n,apex:r,wildcard:{...i,domain:`*.${t}`}}}async function Hi(e){let{stdout:t}=await R(e,`docker ps -q | xargs -r docker inspect -f '{{range $k, $v := .Config.Labels}}{{println $v}}{{end}}' 2>/dev/null || true`,{capture:!0});return[...t.matchAll(/Host\(`([^`]+)`\)/g)].map(e=>e[1])}const Ui=async e=>dt(await Hi(e).catch(()=>[])).filter(t=>!e.domains?.includes(t.domain)),Wi=F({name:`server domain`,args:`[name] [domain...]`,summary:`Show or set a server's main domains.
|
|
583
727
|
|
|
584
728
|
The first main domain is the primary: \`lf deploy\` serves a new site at
|
|
585
729
|
<site>.<primary>, \`--domain blog\` means blog.<primary>, and
|
|
@@ -590,18 +734,18 @@ More main domains are listed and DNS-checked; use them with full names
|
|
|
590
734
|
|
|
591
735
|
Domains given as arguments replace the list (the first becomes primary).
|
|
592
736
|
Without any, it lists them and, if there are none, suggests the base domains
|
|
593
|
-
the server's sites already use.`,options:{add:{type:`string`,short:`a`,multiple:!0,desc:`add a main domain (after the primary)`},primary:{type:`string`,desc:`make this main domain the primary (added if new)`},rm:{type:`string`,multiple:!0,desc:`remove a main domain`},clear:{type:`boolean`,desc:`forget all main domains`},json:{type:`boolean`,desc:`machine-readable output`}},async run(e,t){let n=
|
|
737
|
+
the server's sites already use.`,options:{add:{type:`string`,short:`a`,multiple:!0,desc:`add a main domain (after the primary)`},primary:{type:`string`,desc:`make this main domain the primary (added if new)`},rm:{type:`string`,multiple:!0,desc:`remove a main domain`},clear:{type:`boolean`,desc:`forget all main domains`},json:{type:`boolean`,desc:`machine-readable output`}},async run(e,t){let n=Y(),r=e.length>0&&!(e=>!!n.servers[e]||yt().includes(e))(e[0])&&tt.test(e[0].replace(/^\*\./,``)),i=r?void 0:e[0],a=r?e:e.slice(1),{name:o,server:s}=X(i);if(a.length||t.add||t.rm||t.primary||t.clear){let e=n.servers[o]??={host:o},r=(t.rm??[]).map(nt),i=t.clear?[]:a.length?a.map(nt):[...e.domains??[]];i=[.../* @__PURE__ */ new Set([...i,...(t.add??[]).map(nt)])].filter(e=>!r.includes(e)),i=ot(i,t.primary&&nt(t.primary));let c=r.filter(t=>!e.domains?.includes(t));c.length&&E(`${c.join(`, `)} is not a main domain of ${o}`);let l=(e.domains??[]).filter(e=>!i.includes(e));if(l.length&&await j(`Remove the main domain${l.length>1?`s`:``} ${l.join(`, `)} of ${o}? Sites keep their domains.`),i.length?e.domains=i:delete e.domains,et(n),s.domains=e.domains,w(i.length?`main domains of ${S.bold(o)}: ${i.map((e,t)=>t?e:S.bold(e)).join(`, `)}${i.length>1?S.dim(` (first = primary)`):``}`:`${o} has no main domain`),!i.length)return}let c=s.domains??[];if(!c.length){let e=await Ui(s);if(t.json)return void console.log(JSON.stringify({name:o,domains:c,suggest:e}));T(`${o} has no main domain yet`);for(let t of e)T(`${t.hosts} routed hosts use ${S.bold(t.domain)} — ${S.bold(`lf server domain ${o} --add ${t.domain}`)}`);e.length||T(`set one: ${S.bold(`lf server domain ${o} example.com`)}`);return}let l=await Promise.all(c.map(e=>Vi(s,e)));if(t.json)return void console.log(JSON.stringify({name:o,domains:c.map((e,t)=>({domain:e,primary:t===0,...l[t]}))},null,2));let u=Math.max(...c.map(e=>e.length))+2,d=[];c.forEach((e,t)=>{let n=l[t];for(let e of[n.apex,n.wildcard]){let r=e.ok?S.green(`dns ok`):e.ips.length?S.yellow(`dns → ${e.ips.join(`, `)}`):S.red(`no dns`);console.log(`${e.domain.padEnd(u)} ${r}${e===n.apex&&t===0&&c.length>1?S.dim(` primary`):``}`),e.ok||d.push(` ${e.domain} A ${n.ips[0]??`<server ip>`}`)}}),d.length&&console.log(S.dim(`
|
|
594
738
|
add these DNS records at your DNS provider:
|
|
595
739
|
`)+d.join(`
|
|
596
|
-
`));let f=
|
|
597
|
-
record ${
|
|
740
|
+
`));let f=st(s);T(S.dim(`sites: lf deploy -d blog → blog.${f} · dashboard: lf traefik setup --dashboard traefik`))}});async function Gi(e){let t=e,n=await Cr(t);if(n.values.sudo!==`1`){let r={...e,user:`root`};Z(e).user!==`root`&&await Se(r)||O(`the firewall needs root or passwordless sudo; ${Z(e).user} has no sudo and root's key login does not work`),t=r,n=await Cr(t)}let r=n.values,i=Number(r.ssh_port)||Z(e).port;return{login:t,ufw:r.ufw===`active`?`active`:r.ufw===`missing`?`missing`:`inactive`,policy:r.ufw_in||`DROP`,sshPort:i,rules:n.rules.map(Or),ports:Pr(n),blocked:Nr(n,[i]).blocked,probe:n}}const Ki=/^\d+(:\d+)?(,\d+(:\d+)?)*(\/(tcp|udp))?$/,qi=/^[0-9a-fA-F.:]+(\/\d+)?$/;function Ji(e){Ki.test(e.port)||O(`not a port: ${e.port} (e.g. 5432, 51820/udp, 6000:6007/tcp)`);let[t,n]=e.port.split(`/`);t.split(/[,:]/).some(e=>Number(e)<1||Number(e)>65535)&&O(`ports go from 1 to 65535: ${t}`),/[,:]/.test(t)&&!n&&O(`ufw needs a protocol for port lists and ranges: ${t}/tcp or ${t}/udp`),e.from&&!qi.test(e.from)&&O(`not an address or network: ${e.from} (e.g. 203.0.113.7 or 10.0.0.0/8)`);let r=e.from?[e.action,`from`,e.from,`to`,`any`,`port`,t,...n?[`proto`,n]:[]]:[e.action,e.port];return e.comment?[...r,`comment`,e.comment]:r}const Yi=e=>`ufw_add ${e.map(L).join(` `)}`,Xi=e=>e[0]===`deny`?`${Yi([`prepend`,...e])} 2>/dev/null || ${Yi(e)}`:Yi(e),Zi=e=>`$SUDO ufw --force delete ${e.spec} >/dev/null
|
|
741
|
+
record ${L(`ufw delete ${e.spec}`)} ${L(`$SUDO ufw ${e.action===`allow`||e.action===`limit`?``:`prepend `}${e.spec} >/dev/null 2>&1 || $SUDO ufw ${e.spec} >/dev/null`)}`,Qi=e=>Or(e.map((t,n)=>e[n-1]===`comment`?`'${t}'`:t).join(` `)),$i=`command -v ufw >/dev/null || { echo "ufw is not installed (lf firewall enable installs it)" >&2; exit 1; }`;async function ea(e,t,n){if(e.ufw!==`active`)return;let r=kr(t,{proto:`tcp`,port:e.sshPort})?.rule;if(r&&(r.action===`allow`||r.action===`limit`)&&!r.from)return;let i=r?.from?`only ${r.from} could still reach ssh port ${e.sshPort}`:`this blocks ssh port ${e.sshPort} and can lock you out`;n||await re(`${i}. Do it anyway?`)||O(`${i} (--force to do it anyway)`)}function ta(e,t){let n=/^\d+$/.test(t)?Number(t):e.rules.findIndex(e=>e.spec===t)+1;return e.rules[n-1]||O(`no rule ${t}; \`lf firewall\` lists them (${e.rules.length} rules)`),{rule:e.rules[n-1],n}}const na={server:I,from:{type:`string`,desc:`only from this address or network (e.g. 10.0.0.0/8)`},comment:{type:`string`,desc:`note stored with the rule`}};function ra(e){return F({name:`firewall ${e}`,args:`<port[/proto]>`,summary:e===`allow`?"Open a port in ufw, e.g. `lf firewall allow 5432 --from 10.0.0.0/8` or `lf firewall allow 51820/udp`.":"Block a port in ufw, e.g. `lf firewall deny 5432`. Goes before the other rules, so it wins over an allow.",options:{...na,force:{type:`boolean`,desc:`even if it blocks ssh`}},async run([t],n){t||O(`usage: lf firewall ${e} <port[/proto]> [--from ip]`);let r=Ji({action:e,port:t,from:n.from,comment:n.comment}),i=await Gi(X(n.server).server);e===`deny`&&await ea(i,[Qi(r),...i.rules],n.force),await R(i.login,`${G}\n${$i}\n${Xi(r)}`),w(`${r.join(` `)}${i.ufw===`active`?``:S.dim(` (takes effect once the firewall is on: lf firewall enable)`)}`)}})}const ia=ra(`allow`),aa=ra(`deny`),oa=F({name:`firewall status`,summary:`Show the firewall (ufw): on or off, its rules, and who can reach each listening port.`,options:{server:I,json:{type:`boolean`,desc:`machine-readable output`}},async run(e,t){let{name:n,server:r}=X(t.server),i=await Gi(r);if(t.json){let{ufw:e,policy:t,sshPort:n,rules:r,ports:a,blocked:o}=i;console.log(JSON.stringify({ufw:e,policy:t,sshPort:n,rules:r.map((e,t)=>({n:t+1,...e})),ports:a,blocked:o},null,2));return}let a=i.ufw===`active`?S.green(`on`):i.ufw===`missing`?S.yellow(`not installed`):S.yellow(`off`);C(`firewall on ${n}: ${a}${i.ufw===`active`?S.dim(` · incoming default ${i.policy.toLowerCase()}`):``}`),console.log(`\n${S.bold(`Rules`)}`),i.rules.length||T(S.dim(`none`)),N(i.rules.map((e,t)=>[` ${t+1}`,e.action===`allow`||e.action===`limit`?S.green(e.action):S.red(e.action),e.spec.replace(/^\S+\s+/,``)])),console.log(`\n${S.bold(`Listening ports`)}`);let o={open:S.green,limited:S.yellow,blocked:S.red,local:S.dim};N(i.ports.map(e=>[` ${e.port}`,e.proc,o[e.state](e.why)])),i.ufw!==`active`&&(console.log(),i.blocked.length?E(`enabling would block ${i.blocked.join(`, `)}: allow them first`):T(S.dim(`lf firewall enable turns it on (ssh port ${i.sshPort} stays open)`)))}}),sa=F({name:`firewall enable`,summary:`Turn ufw on (installs it if missing). Always allows the ssh port first; refuses if it would block a port in use.`,options:{server:I,force:{type:`boolean`,desc:`turn it on even if it blocks ports in use`}},async run(e,t){let{name:n,server:r}=X(t.server),i=await Gi(r);if(i.ufw===`active`)return w(`firewall on ${n} is already on`);if(i.blocked.length){let e=`turning the firewall on would block ${i.blocked.join(`, `)}`;t.force||await re(`${e}. Turn it on anyway?`)||O(`${e}. Allow them first (lf firewall allow <port>), or --force`)}await ea({...i,ufw:`active`},[...i.rules,Qi([`allow`,`${i.sshPort}/tcp`])],t.force),await R(i.login,`${G}
|
|
598
742
|
command -v ufw >/dev/null || { log "installing ufw"; pkg_install ufw; record "installed ufw"; }
|
|
599
|
-
${
|
|
600
|
-
ufw_enable`),
|
|
601
|
-
${$
|
|
602
|
-
${
|
|
603
|
-
${
|
|
604
|
-
`).forEach((e,r)=>{let[i,a,o,s,c,l,u,d]=e.split(` `);if(d===void 0||l!==`do`&&l!==`undo`)return;let f=t.get(a);f||t.set(a,f={n:t.size+1,id:a,time:i,actor:o,cmd:c,steps:[]});let p={line:r+1,time:i,user:s,what:u,undone:!1};if(l===`undo`){let e=n.get(Number(u));e&&(e.undone=!0),p.reverts=Number(u),p.what=`undid: ${e?.what??`line ${u}`}`}else d&&(p.undo=Buffer.from(d,`base64`).toString());n.set(p.line,p),f.steps.push(p)}),[...t.values()]}async function
|
|
743
|
+
${Yi([`allow`,`${i.sshPort}/tcp`])}
|
|
744
|
+
ufw_enable`),w(`firewall on ${n} is on; ssh port ${i.sshPort} allowed`)}}),ca=F({name:`firewall disable`,summary:"Turn ufw off. Rules are kept and apply again after `lf firewall enable`.",options:{server:I},async run(e,t){let{name:n,server:r}=X(t.server),i=await Gi(r);if(i.ufw!==`active`)return w(`firewall on ${n} is already off`);await M(`Turn the firewall on ${n} off? Every listening port becomes reachable.`,!1)||O(`cancelled`),await R(i.login,`${G}\n$SUDO ufw disable\nrecord "disabled ufw" '$SUDO ufw --force enable >/dev/null'`),w(`firewall on ${n} is off (${i.rules.length} rules kept)`)}}),la=F({name:`firewall rm`,args:`<number|rule>`,summary:"Remove a rule by its number in `lf firewall`, or by its text (e.g. 'allow 5432').",options:{server:I,force:{type:`boolean`,desc:`even if it blocks ssh`}},async run([e],t){e||O(`usage: lf firewall rm <number|rule>`);let{name:n,server:r}=X(t.server),i=await Gi(r),{rule:a,n:o}=ta(i,e);await ea(i,i.rules.filter(e=>e!==a),t.force),await j(`Remove rule ${o} (${a.spec}) on ${n}?`),await R(i.login,`${G}\n${$i}\n${Zi(a)}`),w(`removed rule ${o}: ${a.spec}`)}}),ua=F({name:`firewall update`,args:`<number|rule>`,summary:`Change a rule: what you pass replaces that part, the rest stays. If ufw rejects the new rule, the old one is restored.`,options:{...na,port:{type:`string`,desc:`port[/proto], e.g. 5432 or 51820/udp`},from:{type:`string`,desc:`only from this address or network; 'any' for everyone`},action:{type:`string`,desc:`allow, deny or limit`},force:{type:`boolean`,desc:`even if it blocks ssh`}},async run([e],t){e||O(`usage: lf firewall update <number|rule> [--port p] [--from ip|any] [--action allow|deny|limit]`);let n=await Gi(X(t.server).server),{rule:r,n:i}=ta(n,e),a=t.action??r.action;[`allow`,`deny`,`limit`].includes(a)||O(`--action must be allow, deny or limit, not ${a}`);let o=t.port??(r.port&&(r.proto?`${r.port}/${r.proto}`:r.port));o||O(`rule ${i} (${r.spec}) names no port; pass --port`);let s=Ji({action:a,port:o,from:t.from===`any`?void 0:t.from??r.from,comment:t.comment??r.comment}),c=n.rules.filter(e=>e!==r);await ea(n,a===`deny`?[Qi(s),...c]:[...c,Qi(s)],t.force),await R(n.login,`${G}
|
|
745
|
+
${$i}
|
|
746
|
+
${Zi(r)}
|
|
747
|
+
${Xi(s)} || { $SUDO ufw ${r.spec} >/dev/null; record "restored ufw ${r.spec}"; echo "kept rule ${i}" >&2; exit 1; }`),w(`rule ${i}: ${r.spec} → ${s.join(` `)}`)}}),da=e=>e.steps.filter(e=>e.undo&&!e.undone);function fa(e){let t=/* @__PURE__ */ new Map,n=/* @__PURE__ */ new Map;return e.split(`
|
|
748
|
+
`).forEach((e,r)=>{let[i,a,o,s,c,l,u,d]=e.split(` `);if(d===void 0||l!==`do`&&l!==`undo`)return;let f=t.get(a);f||t.set(a,f={n:t.size+1,id:a,time:i,actor:o,cmd:c,steps:[]});let p={line:r+1,time:i,user:s,what:u,undone:!1};if(l===`undo`){let e=n.get(Number(u));e&&(e.undone=!0),p.reverts=Number(u),p.what=`undid: ${e?.what??`line ${u}`}`}else if(u===qe)for(let e of n.values())delete e.undo;else d&&(p.undo=Buffer.from(d,`base64`).toString());n.set(p.line,p),f.steps.push(p)}),[...t.values()]}async function pa(e){let{stdout:t}=await R(e,`cat ${W} 2>/dev/null || sudo -n cat ${W} 2>/dev/null || true`,{capture:!0});return fa(t)}function ma(e,t){let n=t.match(/^#?(\d+)(?:\.(\d+))?$/),r=n?e[Number(n[1])-1]:e.find(e=>e.id===t);if(r||O(`no run ${t} in the journal (\`lf log\` lists them)`),!n?.[2])return{run:r,steps:r.steps};let i=r.steps[Number(n[2])-1];return i||O(`run #${r.n} has ${r.steps.length} steps, not ${n[2]}`),{run:r,steps:[i]}}async function ha(e,t){let n=Z(e).user;if(t===n||n===`root`)return{login:e};if(t!==`root`)return{login:{...e,user:t}};let{stdout:r}=await R(e,`sudo -n true 2>/dev/null && echo yes || true`,{capture:!0});if(r.trim()===`yes`)return{login:e,sudo:!0};let i={...e,user:`root`};return await Se(i)?{login:i}:O(`undoing this needs root: ${n} has no passwordless sudo and root's key login does not work`)}const ga=String.raw`
|
|
605
749
|
undo_step() { # undo_step <line> <undo shell, base64>
|
|
606
750
|
set +e
|
|
607
751
|
( set -e; eval "$(printf %s "$2" | base64 -d)" )
|
|
@@ -609,18 +753,18 @@ undo_step() { # undo_step <line> <undo shell, base64>
|
|
|
609
753
|
set -e
|
|
610
754
|
[ "$rc" = 0 ] || { echo "could not undo journal line $1 (exit $rc); later steps are undone, the rest is kept" >&2; exit 1; }
|
|
611
755
|
_journal undo "$1" ""
|
|
612
|
-
}`;async function
|
|
613
|
-
`),{sudo:c}),r.push(s),t=i}return n.length}function
|
|
614
|
-
`)){let e=t.match(/\$SUDO ufw --force delete (.+?) >\/dev\/null/),n=t.match(/\$SUDO ufw (prepend )?((?:allow|deny|reject|limit) .+?) >\/dev\/null/);if(e){let t=
|
|
756
|
+
}`;async function _a(e,t){let n=t.filter(e=>e.undo&&!e.undone).sort((e,t)=>t.line-e.line),r=[e];for(let t=0;t<n.length;){let i=t;for(;i<n.length&&n[i].user===n[t].user;)i++;let a=n.slice(t,i),o=a.map(e=>`undo_step ${e.line} ${L(Buffer.from(e.undo).toString(`base64`))}`),{login:s,sudo:c}=await ha(e,n[t].user);a.some(e=>e.undo.includes(`userdel`))&&await Promise.all(r.map(ve)),await R(s,[G,ga,...o].join(`
|
|
757
|
+
`),{sudo:c}),r.push(s),t=i}return n.length}function va(e,t){let n=S.dim(`${t+1}.`.padStart(4));return e.reverts?`${n} ${S.dim(`↩ `+e.what)}`:e.undone?`${n} ${S.dim(`✓ ${e.what} (undone)`)}`:e.undo?`${n} ${S.cyan(`↺`)} ${e.what}`:`${n} ${S.dim(`· `+e.what+` (not reversible)`)}`}const ya=e=>e.trim().replace(/\\(.)/g,`$1`),ba=(e,t)=>e.action===t.action&&e.port===t.port&&e.proto===t.proto&&e.from===t.from;async function xa(e,t,n){if(!t.some(e=>e.undo.includes(`ufw`)))return;let r=await Gi(e),i=[...r.rules],a=r.ufw;for(let e of[...t].sort((e,t)=>t.line-e.line))for(let t of e.undo.split(`
|
|
758
|
+
`)){let e=t.match(/\$SUDO ufw --force delete (.+?) >\/dev\/null/),n=t.match(/\$SUDO ufw (prepend )?((?:allow|deny|reject|limit) .+?) >\/dev\/null/);if(e){let t=Or(ya(e[1])),n=i.findIndex(e=>ba(e,t));n>=0&&i.splice(n,1)}else n?i=n[1]?[Or(ya(n[2])),...i]:[...i,Or(ya(n[2]))]:/\$SUDO ufw disable/.test(t)?a=`inactive`:/\$SUDO ufw --force enable/.test(t)&&(a=`active`)}await ea({...r,ufw:a},i,n)}const Sa=e=>`${S.bold(`#${e.n}`.padEnd(5))} ${S.dim(P(e.time).padEnd(9))} ${S.bold(e.cmd||`?`)} ${S.dim(`${e.actor} · ${e.id}`)}`,Ca=F({name:`history`,summary:"What landfall changed on a server, newest first. ↺ marks steps `lf undo` can revert.",options:{server:I,n:{type:`string`,short:`n`,desc:`runs to show`,default:`20`},json:{type:`boolean`,desc:`machine-readable output`}},async run(e,t){let{name:n,server:r}=X(t.server),i=(await pa(r)).reverse().slice(0,Number(t.n)||20);if(t.json)return console.log(JSON.stringify(i,null,2));if(!i.length)return T(`nothing in ${W} on ${n} yet`);for(let e of i)console.log(Sa(e)),e.steps.forEach((e,t)=>console.log(va(e,t)));let a=i.find(e=>da(e).length);a&&console.log(S.dim(`\nlf undo reverts #${a.n}; lf undo <n> picks a run, <n>.<step> one step`))}}),wa=F({name:`undo`,args:`[run|run.step]`,summary:"Revert what landfall did: the latest run, run <n> from `lf history`, one step <n>.<m>, or --all.",options:{server:I,all:{type:`boolean`,desc:`everything landfall did that can be reverted`},force:{type:`boolean`,desc:`even if it leaves ufw on without an ssh rule`}},async run([e],t){let{name:n,server:r}=X(t.server),i=await pa(r),a,o;if(t.all)a=i.flatMap(e=>e.steps),o=`everything landfall did on ${n}`;else{let t=e?ma(i,e):[...i].reverse().map(e=>({run:e,steps:e.steps})).find(e=>da(e.run).length);if(!t)return w(`nothing to undo on ${n}`);({steps:a}=t),o=`#${t.run.n} ${t.run.cmd} (${P(t.run.time)})`;let r=i.filter(e=>e.n>t.run.n&&da(e).length);r.length&&E(`later runs build on it and stay: ${r.map(e=>`#${e.n} ${e.cmd}`).join(`, `)}`)}let s=a.filter(e=>e.undo&&!e.undone);if(!s.length)return w(`nothing left to undo in ${o}`);C(`undo ${o}`);for(let e of[...s].reverse())console.error(` ${S.cyan(`↺`)} ${e.what}`);let c=a.filter(e=>!e.undo&&!e.reverts);for(let e of c)console.error(` ${S.dim(`· ${e.what} stays (not reversible)`)}`);await xa(r,s,t.force);let l=`Revert ${s.length} change${s.length>1?`s`:``} on ${n}?`;t.all?await j(l,n):await M(l,!1)||O(`cancelled`),await _a(r,s),w(`reverted ${s.length} change${s.length>1?`s`:``} on ${n}`),s.some(e=>e.what.startsWith(`created user`))&&T(S.dim(`lf still logs in to ${n} as that user: lf server rm ${n}, or lf setup again`))}}),Ta=F({name:`keygen`,args:`<name>`,summary:`Create an ed25519 key pair at ~/.ssh/landfall_<name> (skips if it exists) and print the public key.`,async run([e]){e||O(`usage: lf keygen <name>`);let{path:t,created:n}=ki(e);w(`${n?`created`:`key exists:`} ${J(t)}`),console.log(o.readFileSync(`${t}.pub`,`utf8`).trim())}});async function Ea(e,t){let n=/* @__PURE__ */ new Set;for(let r of e)r.status!==`off`&&(r.status===`conflict`?r.part===`traefik`?E(`skipping traefik: ${r.detail} (free it, then \`lf traefik setup\`)`):t||await re(`${r.label}: ${r.detail}. Apply anyway?`)?n.add(r.part):E(`skipping ${r.label}: ${r.detail} (--force to apply)`):n.add(r.part));return n}async function Da(e,t){C(`traefik settings (enter keeps the default)`),t.image??=e.traefikImage??await ne(`traefik image`,`traefik:v3`),t.hostNetwork===void 0&&e.hostNetwork===void 0&&(T(S.dim(`host network: traefik sees real client IPs (also IPv6) and ufw guards 80/443; default publishes the ports via Docker`)),t.hostNetwork=await M(`run traefik on the host network?`,!1)),t.email===void 0&&e.email===void 0&&(t.email=await ne(`Let's Encrypt e-mail (optional)`,``)||void 0);let n=st(e);t.dashboard??=await ne(`dashboard domain, behind basic auth (optional${n?", `off` for none":``})`,n?`traefik.${n}`:``)||void 0,t.dashboard===`off`&&(t.dashboard=void 0)}const Oa=F({name:`setup`,args:`<name>`,summary:`Prepare a server: SSH key, Docker, firewall, deploy user, Traefik.
|
|
615
759
|
|
|
616
760
|
Turns a fresh box into a deploy target (safe to re-run):
|
|
617
|
-
1. create a dedicated SSH key (~/.ssh/
|
|
761
|
+
1. create a dedicated SSH key (~/.ssh/landfall_<name>) and install it (asks for the password once)
|
|
618
762
|
2. install Docker, firewall (ufw: ssh/80/443), fail2ban, unattended-upgrades
|
|
619
763
|
3. create a deploy user with docker access, disable SSH password login
|
|
620
764
|
4. write \`Host <name>\` to ~/.ssh/config so \`ssh <name>\` just works
|
|
621
765
|
5. install Traefik with automatic Let's Encrypt certificates
|
|
622
766
|
|
|
623
|
-
Works on existing ssh aliases too: \`lf setup
|
|
767
|
+
Works on existing ssh aliases too: \`lf setup vps\`.
|
|
624
768
|
|
|
625
769
|
Before changing anything, setup inspects the server and only does what is
|
|
626
770
|
missing. Steps that would break services already running there are skipped:
|
|
@@ -631,11 +775,11 @@ missing. Steps that would break services already running there are skipped:
|
|
|
631
775
|
a Traefik already running there is used instead (lf traefik use)
|
|
632
776
|
Use --check to only see that report, --force to apply firewall/hardening anyway.
|
|
633
777
|
In a terminal, a first Traefik install asks for image, host network, e-mail and
|
|
634
|
-
dashboard unless given as flags.`,options:{host:{type:`string`,desc:`IP or hostname of a new server`},user:{type:`string`,short:`u`,desc:`initial login user (default: root for --host, else ssh config)`},port:{type:`string`,short:`p`,desc:`ssh port`},key:{type:`string`,short:`i`,desc:`use this private key instead of generating one`},"deploy-user":{type:`string`,desc:`user landfall deploys as (empty = keep login user)`,default:`deploy`},email:{type:`string`,desc:`contact e-mail for the Let's Encrypt account (optional)`},harden:{type:`boolean`,desc:`disable ssh password auth (--no-harden to skip)`,default:!0},firewall:{type:`boolean`,desc:`enable ufw (--no-firewall to skip)`,default:!0},traefik:{type:`boolean`,desc:`install traefik (--no-traefik to skip)`,default:!0},"ssh-config":{type:`boolean`,desc:`write Host block to ~/.ssh/config (--no-ssh-config)`,default:!0},staging:{type:`boolean`,desc:`Let's Encrypt staging CA, remembered (--no-staging to switch back)`},domain:{type:`string`,desc:`main domain: sites default to <site>.<domain> (lf server domain)`},dashboard:{type:`string`,desc:"traefik dashboard domain (`traefik` = traefik.<main domain>)"},image:{type:`string`,desc:`traefik image, remembered (default: ${
|
|
635
|
-
Runs on 127.0.0.1 only; the printed link logs the browser in.`,options:{port:{type:`string`,short:`p`,desc:`port to listen on`,default:`4777`},open:{type:`boolean`,desc:`open the browser (--no-open to only print the link)`,default:!0}},async run(e,t){let{webUi:n}=await import(`./server-
|
|
778
|
+
dashboard unless given as flags.`,options:{host:{type:`string`,desc:`IP or hostname of a new server`},user:{type:`string`,short:`u`,desc:`initial login user (default: root for --host, else ssh config)`},port:{type:`string`,short:`p`,desc:`ssh port`},key:{type:`string`,short:`i`,desc:`use this private key instead of generating one`},"deploy-user":{type:`string`,desc:`user landfall deploys as (empty = keep login user)`,default:`deploy`},email:{type:`string`,desc:`contact e-mail for the Let's Encrypt account (optional)`},harden:{type:`boolean`,desc:`disable ssh password auth (--no-harden to skip)`,default:!0},firewall:{type:`boolean`,desc:`enable ufw (--no-firewall to skip)`,default:!0},traefik:{type:`boolean`,desc:`install traefik (--no-traefik to skip)`,default:!0},"ssh-config":{type:`boolean`,desc:`write Host block to ~/.ssh/config (--no-ssh-config)`,default:!0},staging:{type:`boolean`,desc:`Let's Encrypt staging CA, remembered (--no-staging to switch back)`},domain:{type:`string`,desc:`main domain: sites default to <site>.<domain> (lf server domain)`},dashboard:{type:`string`,desc:"traefik dashboard domain (`traefik` = traefik.<main domain>)"},image:{type:`string`,desc:`traefik image, remembered (default: ${Oe})`},"host-network":{type:`boolean`,desc:`run traefik on the host network: real client IPs, ufw applies; remembered`},check:{type:`boolean`,desc:`only report what is set up and what setup would change`},force:{type:`boolean`,desc:`apply firewall/ssh hardening despite conflicts`},"key-only":{type:`boolean`,desc:`only install the ssh key, change nothing else`},"password-stdin":{type:`boolean`,desc:`read the login password from stdin instead of asking (also: $LANDFALL_PASSWORD)`}},async run([e],t){e||O(`usage: lf setup <name> [--host <ip>]`);let n=Y(),r=n.servers[e],i=yt().includes(e)&&!kt(e),a={host:t.host??r?.host??e,user:t.user??(t.host?`root`:r?.user),port:t.port?Number(t.port):r?.port,key:t.key??r?.key};!t.user&&t[`deploy-user`]&&Z(a).user===t[`deploy-user`]&&await Se({...a,user:`root`})&&(a.user=`root`);let s=Z(a);C(`setting up ${S.bold(e)} ${S.dim(`(${s.user}@${s.hostname}:${s.port})`)}`);let c=0,l=e=>C(`[${++c}/5] ${e}`);l(`ssh key`);let u=await Ai(e,a,{check:t.check,password:await Di(t[`password-stdin`])});if(!u||t[`key-only`])return;let d=u?o.readFileSync(`${u}.pub`,`utf8`).trim():``,f=t[`deploy-user`]===s.user?``:t[`deploy-user`];l(`checking what is already set up`);let p={PUBKEY:d,DEPLOY_USER:f};if(!await Ye(a,t))return;let[m,h,ee]=await Promise.all([Cr(a,p),pr(),mr()]);Object.assign(m.values,{docker_latest:h??``,compose_latest:ee??``});let g=Number(m.values.ssh_port)||s.port,_=Lr(m,{sshPort:g,loginUser:s.user,deployUser:f,firewall:t.firewall,harden:t.harden,traefik:t.traefik}),v=_.find(e=>e.part===`traefik`),y={email:t.email,staging:t.staging,image:t.image,hostNetwork:t[`host-network`],dashboard:t.dashboard,dashboardUser:`admin`},b=v&&!v.proxy&&v.status!==`conflict`&&v.status!==`off`;b&&(v.detail+=S.dim(` · ${Wr(Ur(r??a,y))}`));let x=Ft(m.values.os_id??``,m.values.os_version??``,m.values.pkg??`none`);if(T(`os: ${m.values.os??`unknown`}${m.values.pkg?S.dim(` · ${m.values.pkg}`):``}`),x.note&&(x.level===`ok`?T:E)(x.note),Vr(_),t.check||!u)return;let D=await Ea(_,t.force),k=b&&v.status===`todo`&&te(),A=t.domain?nt(t.domain):r&&st(r);if(A===void 0&&k){let e=await ne(`main domain for sites, e.g. example.com (optional)`,``);A=e.trim()?nt(e):void 0}k&&(await Da({...r??a,domains:ot(r?.domains,A)},y),T(`traefik: ${Wr(Ur(r??a,y))}${y.dashboard?`, dashboard ${y.dashboard}`:``}`));let re=_.filter(e=>e.status!==`done`&&D.has(e.part)).length;if(re&&!await M(`apply the ${re} change${re===1?``:`s`} above?`))return;let j=[`packages`,`docker`,`layout`,`user`,`firewall`,`harden`];_.some(e=>j.includes(e.part)&&e.status!==`done`&&D.has(e.part))?(l(`bootstrapping (docker, firewall, users, ssh hardening)`),await R(a,G+Le,{env:{PUBKEY:d,DEPLOY_USER:f,SSH_PORT:g,HARDEN:D.has(`harden`),FIREWALL:D.has(`firewall`)}}),w(`server bootstrapped`)):(l(`bootstrap`),w(`already bootstrapped, nothing to change`));let N={...a};if(f){let e={...a,user:f};await Se(e)?(w(`deploy user ${S.bold(f)} ready`),N=e):E(`cannot log in as ${f}; staying with ${s.user}`)}l(`ssh config + landfall config`);let P=Mi(e,N,u,{existing:r,sshConfig:t[`ssh-config`],ownAlias:i,port:t.port,keyGiven:!!t.key});A&&(P.domains=ot(P.domains,A)),n.servers[e]=P,n.default??=e,et(n),l(`traefik`),v?.proxy?D.has(`traefik`)&&v.status===`todo`?await Kr(P,v.proxy):w(v.detail):D.has(`traefik`)?await Gr(e,P,y):T(S.dim(`skipped`)),A?(console.log(`\n${S.green(`Done.`)} Point ${S.bold(A)} and ${S.bold(`*.${A}`)} (A records) at ${S.bold(s.hostname)}, then:\n`),console.log(` lf deploy ./dist --domain blog --server ${e} ${S.dim(`# https://blog.${A}`)}`),console.log(` lf server domain ${e} ${S.dim(`# check the DNS`)}\n`)):(console.log(`\n${S.green(`Done.`)} Point a domain's A record at ${S.bold(s.hostname)}, then:\n`),console.log(` lf deploy ./dist --domain example.com --server ${e}\n`))}}),ka=F({name:`ui`,summary:`Web dashboard in your browser: servers, sites, firewall, history, every action.
|
|
779
|
+
Runs on 127.0.0.1 only; the printed link logs the browser in.`,options:{port:{type:`string`,short:`p`,desc:`port to listen on`,default:`4777`},open:{type:`boolean`,desc:`open the browser (--no-open to only print the link)`,default:!0}},async run(e,t){let{webUi:n}=await import(`./server-Cj4TXzYj.mjs`);return n({port:Number(t.port)||4777,open:t.open})}}),Aa={current:S.green,update:S.yellow,unknown:S.dim,pinned:S.dim,rebuild:S.dim,foreign:S.dim,missing:S.red};function ja(e,t){let n=e.updates.filter(e=>e.security).length;if(e.mgr===`none`)return T(`packages: no supported package manager`);let r=e.updates.length?`${S.bold(String(e.updates.length))} package updates${n?`, ${S.yellow(`${n} security`)}`:``}`:S.green(`packages up to date`);console.log(`${r}${e.reboot?S.yellow(` · reboot required`):``}${e.refreshed?``:S.dim(` (package lists not refreshed)`)}`);let i=t?e.updates:e.updates.slice(0,15);N(i.map(e=>[` `+e.name,S.dim(e.from??``),`→ `+e.to,e.security?S.yellow(`security`):``])),i.length<e.updates.length&&console.log(S.dim(` … ${e.updates.length-i.length} more (--all)`))}function Ma(e){e.length&&(console.log(`\n${S.bold(`Images`)}`),N(e.map(e=>[` `+e.name,S.dim(e.ref||`-`),Aa[e.state](e.state===`update`?`newer image`:e.state),S.dim(e.note??``)])))}function Na(e){let t=gr(e);console.log(`\n${S.bold(`Docker`)} ${e.docker?`${e.docker} · compose ${e.compose||S.red(`missing`)}`:S.red(`not installed`)}`);for(let e of[t.dockerNote,t.composeNote])e&&console.log(` `+S.yellow(e));!t.dockerNote&&!t.composeNote&&e.docker&&console.log(S.dim(` newest releases`))}const Pa=F({name:`updates`,summary:`Show pending OS package updates (security, reboot needed) and newer images for traefik and sites. Changes nothing.`,options:{server:I,refresh:{type:`boolean`,desc:`refresh package lists first (apt update; --no-refresh to skip)`,default:!0},all:{type:`boolean`,desc:`list every package`},json:{type:`boolean`,desc:`machine-readable output`}},async run(e,t){let{server:n}=X(t.server),r=await er(n,t.refresh),i=await yr(n),a=await hr(n);if(t.json)return void console.log(JSON.stringify({packages:r,images:i,engine:{...a,...gr(a)}},null,2));ja(r,t.all),Na(a),Ma(i);let o=t.server?` -s ${t.server}`:``,s=i.filter(e=>e.state===`update`).length;(r.updates.length||s)&&console.log(S.dim(`\napply with: lf update${o}`)),gr(a).composeUpdate&&console.log(S.dim(`newest compose: lf update --compose${o}`))}}),Fa=F({name:`update`,args:`[site...]`,summary:`Apply updates: OS packages and/or newer images (traefik, image and static sites).
|
|
636
780
|
|
|
637
781
|
Without --packages/--images both are updated. Package upgrades cannot be undone;
|
|
638
782
|
image updates can (\`lf undo\` puts the old image back). --compose replaces the
|
|
639
|
-
compose plugin setup installed with the newest release (undoable too).`,options:{server:
|
|
640
|
-
`)[0]}`)}}t.push(``,
|
|
641
|
-
`))}async function
|
|
783
|
+
compose plugin setup installed with the newest release (undoable too).`,options:{server:I,packages:{type:`boolean`,desc:`upgrade OS packages`},security:{type:`boolean`,desc:`only security updates (apt, dnf)`},reboot:{type:`boolean`,desc:`reboot afterwards if the upgrade needs it`},images:{type:`boolean`,desc:`pull newer images and recreate their containers`},compose:{type:`boolean`,desc:`update the compose plugin landfall installed to the newest release`}},async run(e,t){let{name:n,server:r}=X(t.server);if(t.compose){(e.length||t.packages||t.images)&&O(`--compose goes alone`);let i=await Zn(r,`updating docker compose`),a=await hr(i),o=gr(a);if(!o.composeUpdate)return void(o.composeNote?T(o.composeNote):w(`compose ${a.compose} is the newest`));await M(`Update compose ${a.compose} to ${a.latestCompose} on ${n}?`)&&(C(`downloading docker compose`),await _r(i),w(`compose updated (lf undo puts the old one back)`));return}let i=!t.packages&&!t.images;e.length&&t.packages&&O(`sites only apply to --images`);let a=!e.length&&(t.packages||i||t.security),o=t.images||i||e.length>0;if(a){let e=await Zn(r,`upgrading packages`),i=await er(e),a=t.security?i.updates.filter(e=>e.security):i.updates;i.mgr===`none`?E(`no supported package manager, skipping packages`):a.length?(ja({...i,updates:a},!1),t.security&&i.mgr===`apk`&&O(`apk has no security-only upgrades; drop --security`),await M(`Upgrade ${a.length} package${a.length===1?``:`s`} on ${n}?`)&&(C(`upgrading packages on ${n}`),await nr(e,{only:t.security&&i.mgr===`apt-get`?a.map(e=>e.name):void 0,what:t.security?`${a.length} security packages`:`${a.length} packages`,reboot:t.reboot}),w(`packages upgraded`),t.reboot&&T(`rebooting if required; give it a minute`))):w(t.security?`no security updates`:`packages up to date`)}if(o){let t=await yr(r);if(e.length){let r=e.filter(e=>!t.some(t=>t.name===e));r.length&&O(`no site or service ${r.join(`, `)} on ${n}`)}let i=e.length?t.filter(t=>e.includes(t.name)):t;for(let e of i.filter(e=>e.state!==`update`&&e.state!==`current`&&e.state!==`unknown`))T(S.dim(`${e.name}: ${e.note??e.state}`));let a=i.filter(t=>t.state===`update`||e.includes(t.name)&&t.state===`unknown`);a.length?(Ma(a),await M(`Pull and recreate ${a.map(e=>e.name).join(`, `)}?`)&&(C(`updating images`),await br(r,a),w(`images updated (lf undo puts the old ones back)`))):w(`images up to date`)}}});var Ia=`0.3.0`;const La=[Oa,Si,yi,ti,ni,ri,di,ci,ai,oi,si,ui,li,mi,hi,gi,Pa,Fa,Ni,Pi,Ri,Bi,Wi,Ii,Fi,Li,Jr,Yr,Xr,Zr,Qr,oa,sa,ca,ia,aa,ua,la,Ca,wa,Ta,ka],Ra={ls:`sites list`,sites:`sites list`,servers:`server list`,"server ls":`server list`,"server ssh":`ssh`,"sites logs":`logs`,"sites env":`env`,"sites rollback":`rollback`,"sites restart":`restart`,"sites stop":`stop`,"sites start":`start`,"sites ls":`sites list`,"sites remove":`sites rm`,"server remove":`server rm`,traefik:`traefik status`,firewall:`firewall status`,"firewall remove":`firewall rm`,log:`history`,revert:`undo`,web:`ui`,info:`server info`,"sites domains":`domains`,"sites auth":`auth`,"sites open":`open`,upgrade:`update`},za=new Map(La.map(e=>[e.name,e]));function Ba(e){for(let t of[2,1]){let n=e.slice(0,t).join(` `),r=za.get(Ra[n]??n);if(r&&e.length>=t)return{cmd:r,rest:e.slice(t)}}return{rest:e}}function Va(){let e=[[`Servers`,[`setup`,`server add`,`server list`,`server info`,`server config`,`server domain`,`server use`,`server rm`,`ssh`,`keygen`]],[`Traefik`,[`traefik setup`,`traefik status`,`traefik logs`,`traefik restart`]],[`Firewall`,[`firewall status`,`firewall enable`,`firewall disable`,`firewall allow`,`firewall deny`,`firewall update`,`firewall rm`]],[`Sites`,[`deploy`,`sites list`,`sites info`,`domains`,`auth`,`open`,`logs`,`env`,`rollback`,`restart`,`stop`,`start`,`sites rm`]],[`Updates`,[`updates`,`update`]],[`History`,[`history`,`undo`]],[`Dashboard`,[`ui`]]],t=[`${S.bold(`landfall`)} ${S.dim(Ia)} — set up servers and deploy sites behind Traefik + HTTPS`,``,`${S.bold(`Usage:`)} lf <command> [options] ${S.dim(`lf <command> --help for details`)}`,` lf ui ${S.dim(`web dashboard in your browser`)}`,` lf tui ${S.dim(`the dashboard in the terminal`)}`];for(let[n,r]of e){t.push(``,S.bold(n));for(let e of r){let n=za.get(e);t.push(` ${(e+(n.args?` `+n.args:``)).padEnd(32)} ${n.summary.split(`
|
|
784
|
+
`)[0]}`)}}t.push(``,S.bold(`Quick start`),` lf setup vps --check ${S.dim(`# what is on vps, what setup would change`)}`,` lf setup vps ${S.dim("# docker + traefik on a server you reach with `ssh vps`")}`,` lf setup box --host 203.0.113.7 ${S.dim("# fresh box (root password once) → `ssh box` works")}`,` lf deploy ./dist -d example.com -s vps ${S.dim(`# publish a static site with HTTPS`)}`,` lf deploy ${S.dim(`# redeploy using ./.landfall.json`)}`,` lf deploy ./dist -y ${S.dim(`# no domain yet: serve at <name>.<ip>.sslip.io`)}`,` lf auth my-site --user anna ${S.dim(`# put a password in front of a site`)}`,` lf updates -s vps && lf update -s vps ${S.dim(`# pending OS/image updates, then apply them`)}`,` lf ls ${S.dim(`# what runs where`)}`,` lf history -s vps && lf undo -s vps ${S.dim(`# what landfall changed, and revert the last of it`)}`,``,S.dim(`Servers are ssh targets: any ~/.ssh/config alias works as --server.`)),console.log(t.join(`
|
|
785
|
+
`))}async function Ha(e){if(e[0]===`tui`&&e.length===1){process.stdin.isTTY&&process.stdout.isTTY||O("the terminal dashboard needs a terminal; `lf ui` opens the web one"),process.env.NODE_ENV??=`production`;let{dashboard:e}=await import(`./tui-0-Gcinq3.mjs`);return e(Ua)}if(!e.length||e[0]===`help`||e[0]===`-h`||e[0]===`--help`)return Va(),0;if(e[0]===`-v`||e[0]===`--version`||e[0]===`version`)return console.log(Ia),0;let{cmd:t,rest:n}=Ba(e);if(!t)return console.error(`${S.red(`error:`)} unknown command "${e.join(` `)}"\n`),Va(),2;let{values:r,positionals:i,rest:a}=se(t,n);if(r.help)return console.log(ce(t)),0;A(!!r.yes),xe.cmd=le(t,i,r);let o=await t.run(i,r,a);return typeof o==`number`?o:0}async function Ua(e){try{return await Ha(e)}catch(e){return e instanceof D?console.error(`${S.red(`error:`)} ${e.message}`):console.error(e),1}}Ua(process.argv.slice(2)).then(e=>process.stdout.write(``,()=>process.exit(e)));export{q as A,H as B,zt as C,$e as D,yt as E,Oe as F,P as H,W as I,U as L,mt as M,X as N,tt as O,et as P,B as R,Nt as S,Z as T,S as U,de as V,ae as W,xn as _,Vi as a,en as b,Ei as c,hr as d,yr as f,$ as g,Fn as h,Gi as i,Y as j,Qe as k,fi as l,An as m,da as n,zi as o,er as p,pa as r,Ui as s,Ia as t,gr as u,Cn as v,Rt as w,Vt as x,tn as y,V as z};
|