openship 0.6.1 → 0.6.6

package/dist/{chunk-YIPMDGG6.js → chunk-RSR7PFIQ.js}

@@ -2,12 +2,22 @@
 ":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
+import {
+  envOps,
+  opScript
+} from "./chunk-YMMQRE5J.js";
+import {
+  resolveEnvironment
+} from "./chunk-UVNMQM7W.js";
 import {
   sq
 } from "./chunk-ZFJXPCQP.js";
 import {
+  SYSTEM,
+  answered,
+  refused,
   safeErrorMessage
-} from "./chunk-OTLSJYAC.js";
+} from "./chunk-UJ6JZM65.js";
 
 // ../../packages/adapters/src/infra/openresty-lua.ts
 import { createHash, randomBytes } from "crypto";
@@ -126,6 +136,40 @@ function edgeRealIpConf() {
   }
   return lines.join("\n") + "\n";
 }
+var CLOUD_EDGE_REAL_IP_HEADER = "X-Real-IP";
+function isCloudFrontedHost(hostname) {
+  const host = hostname.trim().toLowerCase().replace(/\.+$/, "");
+  const suffix = `.${SYSTEM.DOMAINS.CLOUD_DOMAIN.toLowerCase()}`;
+  return host.length > suffix.length && host.endsWith(suffix);
+}
+function cloudEdgeRealIpConf(indent = "    ") {
+  const lines = [
+    "# Openship Cloud's edge fronts this free host, so the peer is the edge and the",
+    "# visitor is named in X-Real-IP (which that front OVERWRITES). The http-scope block",
+    "# reads CF-Connecting-IP for Cloudflare-fronted custom domains, and there is one",
+    "# real_ip_header per scope \u2014 hence this override.",
+    "#",
+    "# Trust is scoped to this VHOST instead of to a peer list, deliberately. The Cloud",
+    "# edge reaches origins from its own address, which this box has no way to know and",
+    "# which Cloudflare's ranges (the visitor\u2192edge leg) do not contain \u2014 so a peer list",
+    "# here silently ignores the header and every free-domain visitor stays the edge.",
+    "#",
+    "# What bounds it is the server_name: this block exists only inside a <slug>.opsh.io",
+    "# vhost, a hostname whose only legitimate path is that edge. Someone who reaches this",
+    "# box directly on :80 with a forged Host AND a forged X-Real-IP can choose their own",
+    "# apparent address for THIS vhost \u2014 accepted, because the alternative is the address",
+    "# being wrong for every visitor all the time. Custom domains keep the peer-anchored",
+    "# http-scope block; do not widen this to them.",
+    `real_ip_header ${CLOUD_EDGE_REAL_IP_HEADER};`,
+    // OFF, unlike the http-scope block: the Cloud edge OVERWRITES X-Real-IP with a single
+    // address, so there is no list to walk, and "skip trusted addresses from the right"
+    // has no meaning once every address is trusted.
+    "real_ip_recursive off;",
+    "set_real_ip_from 0.0.0.0/0;",
+    "set_real_ip_from ::/0;"
+  ];
+  return lines.map((l) => `${indent}${l}`).join("\n") + "\n";
+}
 
 // ../../packages/adapters/src/infra/edge-not-found.ts
 var EDGE_UNROUTED_SENTINEL = "openship-edge-unrouted";
@@ -204,6 +248,7 @@ var OPENRESTY_MGMT_PORT = 9145;
 var OPENRESTY_SITE_LUALIB = OPENRESTY_LUA_DIR.replace(/\/[^/]+$/, "");
 var EDGE_LUA_PACKAGE_PATH = `${OPENRESTY_SITE_LUALIB}/?.lua;;`;
 var EDGE_SERVER_NAMES_HASH_BUCKET_SIZE = 128;
+var EDGE_CLIENT_MAX_BODY_SIZE = "50m";
 var EDGE_SHARED_DICTS = [
   /** Analytics counters. */
   { name: "analytics", size: "256m" },
@@ -266,6 +311,9 @@ var EDGE_CONTAINER_MOUNTS = [
   { host: `${EDGE_HOST_STATE_DIR}/acme`, container: "/var/www/acme" },
   { host: "/opt/openship/static", container: "/opt/openship/static" }
 ];
+var EDGE_SAME_PATH_MOUNTS = EDGE_CONTAINER_MOUNTS.filter(
+  (m) => m.host === m.container
+).map((m) => m.host.replace(/\/+$/, ""));
 var EDGE_HOST_PATHS = {
   bin: OPENRESTY_DEFAULT_PATHS.bin,
   confPath: OPENRESTY_DEFAULT_PATHS.confPath,
@@ -393,6 +441,12 @@ async function ensureOpenRestyConfig(executor, paths) {
       );
     }
   }
+  const hasBodySize = await executor.exec(`grep -qE '^[[:space:]]*client_max_body_size' ${paths.confPath}`).then(() => true).catch(() => false);
+  if (!hasBodySize) {
+    await executor.exec(
+      `sed -i '/http *{/a \\    client_max_body_size ${EDGE_CLIENT_MAX_BODY_SIZE};' ${paths.confPath}`
+    );
+  }
 }
 function MINIMAL_NGINX_CONF(confDir, sitesDir) {
   return `# Auto-generated by Openship - safe to extend
@@ -409,6 +463,9 @@ http {
     # \`nginx -t\` outright for any server_name past ~63 chars, refusing the reload
     # and wedging every route on the box, not just the long one.
     server_names_hash_bucket_size ${EDGE_SERVER_NAMES_HASH_BUCKET_SIZE};
+    # See EDGE_CLIENT_MAX_BODY_SIZE \u2014 nginx's 1 MB default 413s an upload before the app
+    # ever sees it. A project's own value overrides this (server beats http).
+    client_max_body_size ${EDGE_CLIENT_MAX_BODY_SIZE};
     include ${sitesDir}/*.conf;
 }
 `;
@@ -455,7 +512,7 @@ var MANAGEMENT_BLOCK = `# Openship internal management - analytics & live-log st
 ${EDGE_MGMT_SERVER_BLOCK}
 `;
 var ACME_HTTP01_PORT = 49180;
-var ACME_CHALLENGE_LOCATION = `    location /.well-known/acme-challenge/ {
+var ACME_CHALLENGE_LOCATION = `    location ^~ /.well-known/acme-challenge/ {
         proxy_pass http://127.0.0.1:${ACME_HTTP01_PORT};
         proxy_set_header Host $host;
     }`;
@@ -466,7 +523,7 @@ var EDGE_CHALLENGE_HOST_DIR = `${EDGE_HOST_STATE_DIR}/acme/oblien${EDGE_CHALLENG
   /\/$/,
   ""
 );
-var EDGE_CHALLENGE_LOCATION = `    location ${EDGE_CHALLENGE_URL_PREFIX} {
+var EDGE_CHALLENGE_LOCATION = `    location ^~ ${EDGE_CHALLENGE_URL_PREFIX} {
         root ${EDGE_CHALLENGE_ROOT};
         default_type text/plain;
         try_files $uri =404;
@@ -600,27 +657,22 @@ async function ensureLuaScripts(executor, paths) {
   }
 }
 async function installGeoDeps(executor) {
-  try {
-    const hasPkg = async (cmd) => {
-      try {
-        await executor.exec(`command -v ${cmd}`);
-        return true;
-      } catch {
-        return false;
-      }
-    };
-    if (await hasPkg("apt-get")) {
-      await executor.exec(
-        "apt-get update -qq && apt-get install -y -qq libmaxminddb0 libmaxminddb-dev"
+  const profile = await resolveEnvironment(executor).catch((err) => safeErrorMessage(err));
+  const install = typeof profile === "string" ? refused(`the host profile could not be read: ${profile}`) : envOps(profile).pkgInstallVariants({
+    apt: answered(["libmaxminddb0", "libmaxminddb-dev"]),
+    dnf: answered(["libmaxminddb", "libmaxminddb-devel"]),
+    yum: answered(["libmaxminddb", "libmaxminddb-devel"]),
+    apk: answered(["libmaxminddb"]),
+    brew: refused("the bare edge is Linux-only, so Openship has no macOS package for it.")
+  });
+  if (install.supported) {
+    await executor.exec(opScript(install.value)).catch((err) => {
+      console.warn(
+        `[openresty] libmaxminddb install failed \u2014 geo lookups return nil: ${safeErrorMessage(err)}`
       );
-    } else if (await hasPkg("dnf")) {
-      await executor.exec("dnf install -y libmaxminddb libmaxminddb-devel");
-    } else if (await hasPkg("yum")) {
-      await executor.exec("yum install -y libmaxminddb libmaxminddb-devel");
-    } else if (await hasPkg("apk")) {
-      await executor.exec("apk add --no-cache libmaxminddb");
-    }
-  } catch {
+    });
+  } else {
+    console.warn(`[openresty] libmaxminddb not installed \u2014 geo lookups return nil: ${install.reason}`);
   }
   try {
     const exists = await executor.exists(GEOIP_DB_PATH);
@@ -665,12 +717,15 @@ async function deployLuaScripts(executor, paths) {
 }
 
 export {
+  isCloudFrontedHost,
+  cloudEdgeRealIpConf,
   OPENRESTY_LUA_DIR,
   LUA_LOGGER_PATH,
   RULES_GUARD_PATH,
   OPENRESTY_MGMT_PORT,
   EDGE_LUA_PACKAGE_PATH,
   EDGE_SERVER_NAMES_HASH_BUCKET_SIZE,
+  EDGE_CLIENT_MAX_BODY_SIZE,
   EDGE_SHARED_DICTS,
   parseNginxVersion,
   OPENRESTY_DEFAULT_PATHS,
@@ -679,6 +734,7 @@ export {
   EDGE_DEFAULT_CERT_CN,
   EDGE_HOST_STATE_DIR,
   EDGE_CONTAINER_MOUNTS,
+  EDGE_SAME_PATH_MOUNTS,
   EDGE_HOST_PATHS,
   detectOpenRestyPaths,
   buildReloadCommand,

package/dist/{chunk-3LDWWY7U.js → chunk-SM26HDS2.js}

@@ -2,6 +2,44 @@
 ":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
+import {
+  formatDuration,
+  isRemoteConnectionError,
+  safeErrorMessage,
+  systemDebug
+} from "./chunk-UJ6JZM65.js";
+
+// ../../packages/adapters/src/system/probe-exec.ts
+async function tryExec(executor, command, opts) {
+  try {
+    return opts ? await executor.exec(command, opts) : await executor.exec(command);
+  } catch {
+    return null;
+  }
+}
+async function probeExec(executor, command, scope) {
+  const startedAt = Date.now();
+  systemDebug(scope, `exec:start ${command}`);
+  try {
+    const result = await executor.exec(command, { timeout: 1e4 });
+    systemDebug(scope, `exec:ok ${command} (${formatDuration(startedAt)})`);
+    return { output: result.trim(), error: null };
+  } catch (err) {
+    const msg = safeErrorMessage(err);
+    if (isRemoteConnectionError(err)) {
+      systemDebug(scope, `exec:abort ${command} (${formatDuration(startedAt)}) ${msg}`);
+      throw err;
+    }
+    systemDebug(scope, `exec:fail ${command} (${formatDuration(startedAt)}) ${msg}`);
+    return { output: "", error: msg || `\`${command}\` failed` };
+  }
+}
+function withReason(message, error) {
+  if (!error) return message;
+  const first = error.split("\n").map((line) => line.trim()).find(Boolean);
+  if (!first) return message;
+  return `${message} \u2014 ${first.length > 200 ? `${first.slice(0, 199)}\u2026` : first}`;
+}
 
 // ../../packages/adapters/src/system/port-listen.ts
 var PROC_NET_TCP_CMD = "cat /proc/net/tcp 2>/dev/null; cat /proc/net/tcp6 2>/dev/null; true";
@@ -75,13 +113,6 @@ async function waitForPortFree(executor, port, opts = {}) {
 }
 
 // ../../packages/adapters/src/runtime/port-conflict.ts
-async function tryExec(executor, command) {
-  try {
-    return await executor.exec(command);
-  } catch {
-    return null;
-  }
-}
 async function resolveSystemdUnit(executor, pid) {
   const cgroup = await tryExec(executor, `cat /proc/${pid}/cgroup 2>/dev/null || true`);
   const unitMatch = cgroup?.match(/(?:^|\/)([^/\n]+\.service)(?:$|\n|\/)/m) ?? cgroup?.match(/(?:^|\/)([^/\n]+\.service)(?:$|\n|\/)/m);
@@ -144,6 +175,9 @@ async function describeProcess(executor, pid) {
 }
 
 export {
+  tryExec,
+  probeExec,
+  withReason,
   waitForPortListening,
   waitForPortFree,
   probeListeningPort,