openship 0.6.0 → 0.6.5

package/dist/chunk-HPXP6LXZ.js

@@ -0,0 +1,428 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  OS_DIR
+} from "./chunk-ELGRMZOW.js";
+import {
+  beginEdgeTakeover,
+  collectProxyCerts,
+  completeEdgeTakeover,
+  copyStaticRootIntoEdge,
+  detectInstalledProxy,
+  edgeProxy,
+  edgeProxyFor,
+  foreignProxyOnEdge,
+  importSites,
+  recoverInterruptedTakeover,
+  rollbackEdgeTakeover,
+  scanImportableSites,
+  unreachableStaticRoots
+} from "./chunk-7334NSJL.js";
+import {
+  LocalExecutor
+} from "./chunk-6FH4AXVY.js";
+import {
+  ourEdgeContainerRunning
+} from "./chunk-WE7BXW6L.js";
+
+// src/lib/edge-preflight.ts
+import { spawnSync } from "child_process";
+import { existsSync, mkdirSync, writeFileSync } from "fs";
+import { join } from "path";
+import chalk from "chalk";
+import { isCancel, log, note, select } from "@clack/prompts";
+function privilegeClause(privilegeDegraded) {
+  if (!privilegeDegraded) return "";
+  return " \u2014 and Openship could not run the stop as root on this host (see the privilege warning above), so stopping it was almost certainly refused rather than too slow. Retrying as this user will fail the same way: re-run as root, or as a user with passwordless sudo";
+}
+async function planAndApplyHostEdge(opts, overrides = {}) {
+  const deps = { ...defaultDeps(), ...overrides };
+  if (deps.platform !== "linux") return { proceed: true };
+  const executor = deps.makeExecutor();
+  await deps.recoverInterruptedTakeover(
+    executor,
+    (m, l) => deps.warn(l === "info" ? m : chalk.yellow(m)),
+    () => deps.ourEdgeContainerRunning(executor)
+  ).catch(() => {
+  });
+  const { status, blocked, owner } = await deps.foreignProxyOnEdge(executor);
+  if (!blocked) {
+    return await offerStoppedProxyImport(executor, deps);
+  }
+  const { sites, warnings } = await deps.importSites(executor, status);
+  const action = await resolveAction(opts.edge, { status, owner, sites, warnings }, deps);
+  if (action === "cancel") return { proceed: false };
+  const certPems = action === "migrate" ? await deps.collectCerts(executor, sites, { status }) : void 0;
+  const staticRootOverrides = action === "migrate" ? await remediateUnreachableStaticRoots({
+    unreachable: unreachableStaticRoots(sites, { containerEdge: true }),
+    executor,
+    interactive: deps.interactive
+  }) : void 0;
+  const freed = await deps.beginEdgeTakeover(
+    executor,
+    status,
+    (m, l) => deps.warn(l === "info" ? m : chalk.yellow(m))
+  );
+  if (!freed.freed) {
+    const plural = freed.stillBound.length > 1;
+    const restored = await deps.rollbackHostEdge();
+    return {
+      proceed: false,
+      blockedBy: `port${plural ? "s" : ""} ${freed.stillBound.join(" and ")} ${plural ? "are" : "is"} still in use after stopping ${owner}` + (restored ? " (the previous proxy has been restored)" : "") + privilegeClause(freed.privilegeDegraded)
+    };
+  }
+  return action === "migrate" ? { proceed: true, action, sites, certPems, staticRootOverrides } : { proceed: true, action };
+}
+async function previewHostEdge(overrides = {}) {
+  const deps = { ...defaultDeps(), ...overrides };
+  const empty = { owner: null, blocked: false, sites: [], warnings: [] };
+  if (deps.platform !== "linux") return empty;
+  try {
+    const executor = deps.makeExecutor();
+    const { status, blocked, owner } = await deps.foreignProxyOnEdge(executor);
+    if (!blocked) return { ...empty, owner: owner || null };
+    const { sites, warnings } = await deps.importSites(executor, status);
+    return { owner: owner || null, blocked: true, sites, warnings };
+  } catch {
+    return empty;
+  }
+}
+async function rollbackHostEdge() {
+  if (process.platform !== "linux") return false;
+  try {
+    return await rollbackEdgeTakeover(
+      new LocalExecutor(),
+      (entry) => console.log(chalk.yellow(`  ${entry.message}`))
+    );
+  } catch {
+    return false;
+  }
+}
+var IMPORTED_MARKER = join(OS_DIR, "imported-proxy");
+function edgeServedHostnames() {
+  const served = /* @__PURE__ */ new Set();
+  const r = spawnSync(
+    "docker",
+    [
+      "exec",
+      "openship-edge",
+      "sh",
+      "-c",
+      "cat /usr/local/openresty/nginx/conf/sites-enabled/*.conf 2>/dev/null || true"
+    ],
+    { encoding: "utf8" }
+  );
+  if (r.status !== 0 || !r.stdout) return served;
+  for (const m of r.stdout.matchAll(/server_name\s+([^;]+);/g)) {
+    for (const host of m[1].trim().split(/\s+/)) {
+      if (host && host !== "_") served.add(host.toLowerCase());
+    }
+  }
+  return served;
+}
+function markStoppedProxyImported() {
+  try {
+    mkdirSync(OS_DIR, { recursive: true, mode: 448 });
+    writeFileSync(IMPORTED_MARKER, (/* @__PURE__ */ new Date()).toISOString(), { mode: 384 });
+  } catch {
+  }
+}
+async function offerStoppedProxyImport(executor, deps) {
+  if (!deps.interactive || existsSync(IMPORTED_MARKER)) return { proceed: true };
+  let proxy = null;
+  try {
+    proxy = await deps.detectInstalledProxy(executor);
+  } catch {
+    return { proceed: true };
+  }
+  if (!proxy) return { proceed: true };
+  let sites = [];
+  let warnings = [];
+  try {
+    const scan = await deps.scanProxySites(executor, proxy);
+    sites = scan.sites;
+    warnings = scan.warnings;
+  } catch {
+    return { proceed: true };
+  }
+  if (sites.length === 0) return { proceed: true };
+  const served = deps.edgeServedHostnames();
+  const pending = sites.filter(
+    (site) => !site.serverNames.every((h) => served.has(h.trim().toLowerCase()))
+  );
+  if (pending.length === 0) return { proceed: true };
+  sites = pending;
+  deps.render({ owner: `${proxy} (stopped)`, sites, warnings });
+  if (!await deps.confirmStoppedImport({ proxy, count: sites.length })) {
+    return { proceed: true };
+  }
+  return {
+    proceed: true,
+    action: "migrate",
+    sites,
+    certPems: await deps.collectCerts(executor, sites, { proxy })
+  };
+}
+function dockerState(name) {
+  const r = spawnSync(
+    "docker",
+    ["ps", "-a", "--filter", `name=^${name}$`, "--format", "{{.State}}"],
+    { encoding: "utf8" }
+  );
+  const state = (r.stdout ?? "").trim();
+  return { exists: state.length > 0, running: state === "running" };
+}
+async function diagnoseEdge() {
+  const empty = {
+    containerExists: false,
+    containerRunning: false,
+    occupant: null,
+    hostProxySquatting: false,
+    sites: [],
+    healthy: false
+  };
+  if (process.platform !== "linux") return empty;
+  const { exists, running } = dockerState("openship-edge");
+  const executor = new LocalExecutor();
+  let status;
+  let owner = null;
+  try {
+    const probe = await foreignProxyOnEdge(executor);
+    status = probe.status;
+    owner = probe.owner || null;
+  } catch {
+    return { ...empty, containerExists: exists, containerRunning: running };
+  }
+  const foreignOccupants = status.occupants.filter((o) => o.containerName !== "openship-edge");
+  const hostProxySquatting = !running && foreignOccupants.some((o) => !o.containerName);
+  let sites = [];
+  if (status.occupants.length > 0) {
+    try {
+      sites = (await importSites(executor, status)).sites;
+    } catch {
+    }
+  }
+  return {
+    containerExists: exists,
+    containerRunning: running,
+    occupant: foreignOccupants.length > 0 ? owner : null,
+    hostProxySquatting,
+    sites,
+    healthy: running && foreignOccupants.length === 0
+  };
+}
+async function repairEdgeConflict(mode, apiPort, onLog) {
+  if (process.platform !== "linux") {
+    return { ok: false, registered: [], detail: "the containerized edge is Linux-only" };
+  }
+  const executor = new LocalExecutor();
+  const { status, owner } = await foreignProxyOnEdge(executor);
+  if (status.occupants.length === 0) {
+    spawnSync("docker", ["restart", "openship-edge"], { stdio: "ignore" });
+    return { ok: true, registered: [], detail: "ports were already free \u2014 restarted the edge" };
+  }
+  const scan = mode === "migrate" ? await importSites(executor, status) : { sites: [], warnings: [] };
+  const certPems = mode === "migrate" ? await collectCertsFromProxy(executor, scan.sites, { status }) : void 0;
+  const freed = await beginEdgeTakeover(
+    executor,
+    status,
+    (entry) => onLog(entry.message, entry.level)
+  );
+  if (!freed.freed) {
+    const restored = await rollbackHostEdge();
+    return {
+      ok: false,
+      registered: [],
+      detail: `port${freed.stillBound.length > 1 ? "s" : ""} ${freed.stillBound.join(" and ")} still in use after stopping ${owner || "the existing proxy"}` + (restored ? " \u2014 the previous proxy has been restored" : " \u2014 and the restore did NOT bring it back") + privilegeClause(freed.privilegeDegraded)
+    };
+  }
+  spawnSync("docker", ["restart", "openship-edge"], { stdio: "ignore" });
+  if (mode === "migrate" && scan.sites.length > 0) {
+    const { importMigratedSites } = await import("./edge-import-MCJNVTZ2.js");
+    const outcome = await importMigratedSites(apiPort, scan.sites, certPems);
+    if (outcome.registered.length === 0) {
+      return {
+        ok: false,
+        registered: [],
+        detail: `freed the ports but registered none of the ${scan.sites.length} site(s) \u2014 journal kept so the old proxy can be restored`
+      };
+    }
+    await completeHostEdge();
+    return {
+      ok: true,
+      registered: outcome.registered,
+      detail: `migrated ${outcome.registered.length}/${scan.sites.length} site(s) and restarted the edge`
+    };
+  }
+  await completeHostEdge();
+  return { ok: true, registered: [], detail: "freed :80/:443 and restarted the edge" };
+}
+async function completeHostEdge() {
+  if (process.platform !== "linux") return;
+  try {
+    await completeEdgeTakeover(new LocalExecutor());
+  } catch {
+  }
+}
+async function resolveAction(flag, ctx, deps) {
+  if (flag) return flag;
+  if (!deps.interactive) {
+    deps.warn(
+      `An existing proxy (${ctx.owner}) holds :80/:443 and this is a non-interactive run. Re-run with --edge=migrate (import its sites), --edge=takeover (stop it, sites drop), or --edge=cancel. Leaving it running.`
+    );
+    return "cancel";
+  }
+  deps.render({ owner: ctx.owner, sites: ctx.sites, warnings: ctx.warnings });
+  return deps.confirm({
+    owner: ctx.owner,
+    known: ctx.status.classification === "known",
+    importable: ctx.sites.length
+  });
+}
+async function collectCertsFromProxy(executor, sites, source) {
+  const api = source.proxy ? edgeProxyFor(executor, source.proxy) : await edgeProxy(executor, source.status ? { status: source.status } : {});
+  if (!api) return {};
+  const { certPems, warnings } = await collectProxyCerts(api, sites);
+  for (const w of warnings) console.log(chalk.yellow(`  ${w}`));
+  return certPems;
+}
+function renderEdgeConflict(info) {
+  const { owner, sites, warnings } = info;
+  if (sites.length > 0) {
+    const lines = sites.map((st) => {
+      const host = (st.serverNames ?? []).join(", ") || "(no server_name)";
+      const dest = st.target.kind === "static" ? `static: ${st.target.root}` : st.target.url;
+      return `${chalk.bold(host)} \u2192 ${chalk.dim(dest)}${st.ssl ? chalk.green(" [TLS]") : ""}`;
+    });
+    note(lines.join("\n"), `Detected ${sites.length} site${sites.length === 1 ? "" : "s"} on ${owner}`);
+  }
+  if (warnings.length > 0) {
+    log.warn(`${warnings.length} config item${warnings.length === 1 ? "" : "s"} won't migrate automatically:`);
+    for (const w of warnings.slice(0, 8)) log.message(chalk.dim(`\u2022 ${w}`));
+  }
+}
+async function confirmEdgeAction(info) {
+  const { owner, known, importable } = info;
+  const choice = await select({
+    message: known ? `An existing reverse proxy (${owner}) is serving ports 80/443.` : `Ports 80/443 are in use by ${owner}, which we couldn't identify.`,
+    options: [
+      ...importable > 0 ? [
+        {
+          value: "migrate",
+          label: `Migrate ${importable} site${importable === 1 ? "" : "s"} & take over`,
+          hint: "import the existing sites into Openship's edge, then take 80/443"
+        }
+      ] : [],
+      {
+        value: "takeover",
+        label: "Stop it & take over 80/443",
+        hint: known ? "the existing sites stop being served" : "may interrupt a running service"
+      },
+      { value: "cancel", label: "Cancel \u2014 leave it running" }
+    ],
+    // Default to MIGRATE whenever there are sites we can import: it's the only
+    // option that both gets Openship onto 80/443 and keeps the operator's
+    // existing sites served, so it's the choice they almost always want and
+    // the one that loses nothing on a reflexive Enter.
+    // With nothing importable there's no safe default: a known proxy falls
+    // back to cancel (blind Enter would stop sites that are being served),
+    // and an unidentified port holder to takeover.
+    initialValue: importable > 0 ? "migrate" : known ? "cancel" : "takeover"
+  });
+  return isCancel(choice) ? "cancel" : choice;
+}
+async function remediateUnreachableStaticRoots(opts) {
+  const { unreachable } = opts;
+  if (unreachable.length === 0) return void 0;
+  note(
+    unreachable.map((u) => `${chalk.bold(u.host)} \u2192 ${chalk.dim(u.root)}`).join("\n"),
+    `${unreachable.length} static site${unreachable.length === 1 ? "" : "s"} rooted outside the edge`
+  );
+  log.warn("Their files live outside the edge container's mounts, so they'd return 500 after cutover.");
+  let copy = true;
+  if (opts.interactive) {
+    const choice = await select({
+      message: "Copy these sites' files into the edge so they keep serving?",
+      options: [
+        {
+          value: "copy",
+          label: `Copy ${unreachable.length === 1 ? "it" : "all"} into the edge`,
+          hint: "snapshot the files under /opt/openship/static (recommended)"
+        },
+        {
+          value: "leave",
+          label: "Leave as-is",
+          hint: "they stop serving until you mount their directory yourself"
+        }
+      ],
+      initialValue: "copy"
+    });
+    copy = !isCancel(choice) && choice === "copy";
+  } else {
+    log.info("Non-interactive: copying unreachable static roots into the edge.");
+  }
+  if (!copy) return void 0;
+  const overrides = {};
+  for (const u of unreachable) {
+    try {
+      const newRoot = await copyStaticRootIntoEdge(opts.executor, { root: u.root, host: u.host });
+      overrides[u.host] = newRoot;
+      log.success(`Copied ${u.host} \u2192 ${newRoot}`);
+    } catch (err) {
+      log.warn(
+        `Couldn't copy ${u.host} (${u.root}) \u2014 it will migrate as-is: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  return Object.keys(overrides).length > 0 ? overrides : void 0;
+}
+function defaultDeps() {
+  return {
+    platform: process.platform,
+    interactive: Boolean(process.stdin.isTTY && process.stdout.isTTY),
+    makeExecutor: () => new LocalExecutor(),
+    foreignProxyOnEdge,
+    importSites,
+    beginEdgeTakeover: (executor, status, onLog) => beginEdgeTakeover(executor, status, (entry) => onLog(entry.message, entry.level)),
+    rollbackHostEdge,
+    recoverInterruptedTakeover: (executor, onLog, isEdgeHealthy) => recoverInterruptedTakeover(
+      executor,
+      (entry) => onLog(entry.message, entry.level),
+      isEdgeHealthy
+    ),
+    ourEdgeContainerRunning,
+    detectInstalledProxy,
+    scanProxySites: scanImportableSites,
+    edgeServedHostnames,
+    confirmStoppedImport: async ({ proxy, count }) => {
+      const take = await select({
+        message: `${proxy} is stopped but still has ${count} site(s) not served by Openship \u2014 import them?`,
+        options: [
+          { value: "import", label: `Import ${count} site(s)`, hint: "serve them from Openship's edge" },
+          { value: "skip", label: "Skip", hint: "leave them unserved" }
+        ],
+        initialValue: "import"
+      });
+      return !isCancel(take) && take === "import";
+    },
+    collectCerts: collectCertsFromProxy,
+    render: renderEdgeConflict,
+    confirm: confirmEdgeAction,
+    warn: (message) => console.log(chalk.yellow(`  ${message}`))
+  };
+}
+
+export {
+  planAndApplyHostEdge,
+  previewHostEdge,
+  rollbackHostEdge,
+  markStoppedProxyImported,
+  diagnoseEdge,
+  repairEdgeConflict,
+  completeHostEdge,
+  renderEdgeConflict,
+  confirmEdgeAction,
+  remediateUnreachableStaticRoots
+};