openship 0.6.1 → 0.6.6

package/dist/{nginx-YOEEFBTE.js → nginx-KUFMLMAC.js}

@@ -5,25 +5,33 @@ const require = __ospCreateRequire(import.meta.url);
 import {
   MANAGED_STATIC_BASE,
   NginxProvider,
+  VHOST_GENERATION,
   acmeKeyArgs,
   assertValidChallengeToken,
+  isAcmePortBindFailure,
+  readVhostGeneration,
   renderGeoEntries,
   renderProxyOptions,
   renderProxyTlsOptions,
   summarizeCertbotFailure
-} from "./chunk-EW6KB2J7.js";
+} from "./chunk-QVW76WDL.js";
+import "./chunk-RSR7PFIQ.js";
 import "./chunk-I3DPMTSF.js";
-import "./chunk-VZ2ZHPS2.js";
-import "./chunk-3LDWWY7U.js";
-import "./chunk-YIPMDGG6.js";
+import "./chunk-YMMQRE5J.js";
+import "./chunk-UVNMQM7W.js";
 import "./chunk-ZFJXPCQP.js";
-import "./chunk-OTLSJYAC.js";
+import "./chunk-2YM3NI2E.js";
+import "./chunk-SM26HDS2.js";
+import "./chunk-UJ6JZM65.js";
 import "./chunk-PXKCZB2I.js";
 export {
   MANAGED_STATIC_BASE,
   NginxProvider,
+  VHOST_GENERATION,
   acmeKeyArgs,
   assertValidChallengeToken,
+  isAcmePortBindFailure,
+  readVhostGeneration,
   renderGeoEntries,
   renderProxyOptions,
   renderProxyTlsOptions,

package/dist/node-bootstrap.js

@@ -0,0 +1,241 @@
+// src/node-bootstrap.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { existsSync as existsSync2 } from "fs";
+import { join as join4 } from "path";
+import { createInterface } from "readline";
+
+// src/lib/node-runtime.ts
+import { execFileSync, spawnSync } from "child_process";
+import { chmodSync, existsSync, lstatSync, mkdirSync as mkdirSync2, rmSync, symlinkSync, writeFileSync } from "fs";
+import { join as join3 } from "path";
+
+// src/lib/cache.ts
+import { createHash } from "crypto";
+import { createReadStream, createWriteStream, mkdirSync } from "fs";
+import { dirname, join as join2 } from "path";
+
+// src/lib/paths.ts
+import { homedir } from "os";
+import { join, resolve } from "path";
+var DEFAULT_HOME = join(homedir(), ".openship");
+var override = process.env.OPENSHIP_HOME?.trim();
+var OS_DIR = override ? resolve(override) : DEFAULT_HOME;
+var DATA_DIR = join(OS_DIR, "data");
+var LOG_DIR = join(OS_DIR, "logs");
+var AUTH_SECRET_FILE = join(OS_DIR, "auth-secret");
+var INTERNAL_TOKEN_FILE = join(OS_DIR, "internal-token");
+
+// src/lib/cache.ts
+var CACHE_DIR = join2(OS_DIR, "cache");
+var RELEASES_DIR = join2(CACHE_DIR, "releases");
+async function downloadToFile(url, dest, onProgress) {
+  const res = await fetch(url, { headers: { "User-Agent": "openship-cli" } });
+  if (!res.ok || !res.body) throw new Error(`HTTP ${res.status} for ${url}`);
+  mkdirSync(dirname(dest), { recursive: true });
+  const total = Number(res.headers.get("content-length")) || 0;
+  const hash = createHash("sha256");
+  const file = createWriteStream(dest);
+  const reader = res.body.getReader();
+  let received = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      hash.update(value);
+      if (!file.write(Buffer.from(value))) {
+        await new Promise((r) => file.once("drain", r));
+      }
+      received += value.length;
+      onProgress?.(received, total);
+    }
+  } finally {
+    file.end();
+  }
+  await new Promise((resolve2, reject) => {
+    file.on("finish", () => resolve2());
+    file.on("error", reject);
+  });
+  return { sha256: hash.digest("hex"), size: received };
+}
+
+// src/lib/node-runtime.ts
+var NODE_MAJOR = 22;
+var NODE_DIST = "https://nodejs.org/dist";
+var RUNTIME_DIR = join3(OS_DIR, "runtime");
+var RUNTIME_CURRENT = join3(RUNTIME_DIR, "current");
+var BIN_DIR = join3(OS_DIR, "bin");
+var LAUNCHER_PATH = join3(BIN_DIR, "openship");
+var LAUNCHER_SH = `#!/bin/sh
+# Openship CLI launcher \u2014 runs the tarball-installed CLI under Node.
+# Managed by scripts/install.sh and \`openship update\`; manual edits are overwritten.
+SELF="$0"
+while [ -L "$SELF" ]; do
+  _t="$(readlink "$SELF")"
+  case "$_t" in /*) SELF="$_t" ;; *) SELF="$(dirname "$SELF")/$_t" ;; esac
+done
+BIN_DIR="$(cd "$(dirname "$SELF")" && pwd)"
+HOME_DIR="$(dirname "$BIN_DIR")"
+CLI="$HOME_DIR/cli/current/dist/index.js"
+VENDORED_NODE="$HOME_DIR/runtime/current/bin/node"
+# Prefer a system node >= ${NODE_MAJOR}; fall back to the vendored runtime.
+if command -v node >/dev/null 2>&1 && node -e 'process.exit(+process.versions.node.split(".")[0]>=${NODE_MAJOR}?0:1)' 2>/dev/null; then
+  exec node "$CLI" "$@"
+elif [ -x "$VENDORED_NODE" ]; then
+  exec "$VENDORED_NODE" "$CLI" "$@"
+else
+  echo "openship: no Node >= ${NODE_MAJOR} found (system or vendored). Reinstall: curl -fsSL https://get.openship.io | sh" >&2
+  exit 127
+fi
+`;
+function nodeDistOs() {
+  if (process.platform === "darwin") return "darwin";
+  if (process.platform === "linux") return "linux";
+  throw new Error(`Unsupported platform for vendored Node: ${process.platform}`);
+}
+function nodeDistArch() {
+  if (process.arch === "x64") return "x64";
+  if (process.arch === "arm64") return "arm64";
+  throw new Error(`Unsupported arch for vendored Node: ${process.arch}`);
+}
+function majorOf(bin) {
+  try {
+    const out = execFileSync(bin, ["-e", "process.stdout.write(process.versions.node)"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    const m = Number(out.trim().split(".")[0]);
+    return Number.isInteger(m) ? m : null;
+  } catch {
+    return null;
+  }
+}
+function repoint(link, target) {
+  try {
+    if (lstatSync(link)) rmSync(link, { recursive: true, force: true });
+  } catch {
+  }
+  symlinkSync(target, link);
+}
+async function resolveLatestNode() {
+  const res = await fetch(`${NODE_DIST}/index.json`, {
+    headers: { "User-Agent": "openship-cli" },
+    signal: AbortSignal.timeout(15e3)
+  });
+  if (!res.ok) throw new Error(`Node dist index lookup failed: HTTP ${res.status}`);
+  const rows = await res.json();
+  const prefix = `v${NODE_MAJOR}.`;
+  const row = rows.find((r) => r.version.startsWith(prefix) && r.lts) ?? rows.find((r) => r.version.startsWith(prefix));
+  if (!row) throw new Error(`No Node ${NODE_MAJOR}.x release found on nodejs.org`);
+  return row.version;
+}
+async function fetchVendoredNode(onLog) {
+  const ver = await resolveLatestNode();
+  const os = nodeDistOs();
+  const arch = nodeDistArch();
+  const name = `node-${ver}-${os}-${arch}.tar.gz`;
+  mkdirSync2(RUNTIME_DIR, { recursive: true });
+  const tarball = join3(RUNTIME_DIR, name);
+  onLog?.(`Fetching Node ${ver} (${os}-${arch}) from nodejs.org\u2026`);
+  const { sha256 } = await downloadToFile(`${NODE_DIST}/${ver}/${name}`, tarball);
+  const shaRes = await fetch(`${NODE_DIST}/${ver}/SHASUMS256.txt`, {
+    headers: { "User-Agent": "openship-cli" },
+    signal: AbortSignal.timeout(15e3)
+  });
+  if (!shaRes.ok) {
+    rmSync(tarball, { force: true });
+    throw new Error(`Node checksum list fetch failed: HTTP ${shaRes.status}`);
+  }
+  const expected = (await shaRes.text()).split("\n").map((l) => l.trim()).find((l) => l.endsWith(` ${name}`) || l.endsWith(`  ${name}`))?.split(/\s+/)[0]?.toLowerCase();
+  if (!expected) {
+    rmSync(tarball, { force: true });
+    throw new Error(`No checksum for ${name} in SHASUMS256.txt`);
+  }
+  if (expected !== sha256) {
+    rmSync(tarball, { force: true });
+    throw new Error(`Node download checksum mismatch (expected ${expected}, got ${sha256}).`);
+  }
+  const unpacked = join3(RUNTIME_DIR, `node-${ver}-${os}-${arch}`);
+  rmSync(unpacked, { recursive: true, force: true });
+  const untar = spawnSync("tar", ["-xzf", tarball, "-C", RUNTIME_DIR], { stdio: "inherit" });
+  if (untar.status !== 0) throw new Error("Failed to extract the Node runtime (is `tar` available?).");
+  rmSync(tarball, { force: true });
+  const nodeBin = join3(unpacked, "bin", "node");
+  if (!existsSync(nodeBin)) throw new Error(`Node unpacked but ${nodeBin} is missing (unexpected layout).`);
+  repoint(RUNTIME_CURRENT, unpacked);
+  return nodeBin;
+}
+async function ensureNodeRuntime(onLog) {
+  if ((majorOf("node") ?? 0) >= NODE_MAJOR) return { node: "node", source: "system" };
+  const existing = join3(RUNTIME_CURRENT, "bin", "node");
+  if (existsSync(existing) && (majorOf(existing) ?? 0) >= NODE_MAJOR) {
+    return { node: existing, source: "vendored" };
+  }
+  return { node: await fetchVendoredNode(onLog), source: "vendored" };
+}
+
+// src/node-bootstrap.ts
+var NODE_REEXEC_ENV = "OPENSHIP_NODE_REEXEC";
+var VENDOR_ENV = "OPENSHIP_VENDOR_NODE";
+var vendoredNode = () => join4(OS_DIR, "runtime", "current", "bin", "node");
+function majorOf2(bin) {
+  const out = spawnSync2(bin, ["-e", "process.stdout.write(process.versions.node)"], {
+    encoding: "utf8"
+  });
+  if (out.status !== 0) return 0;
+  return Number.parseInt(out.stdout.trim().split(".")[0] ?? "", 10) || 0;
+}
+function reexec(nodeBin, cliPath) {
+  const res = spawnSync2(nodeBin, [cliPath, ...process.argv.slice(2)], {
+    stdio: "inherit",
+    env: { ...process.env, [NODE_REEXEC_ENV]: "1" }
+  });
+  return { handled: true, status: res.status ?? 1 };
+}
+function isAffirmative(answer) {
+  return !/^n/i.test(answer.trim());
+}
+function ask(question) {
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  return new Promise((resolve2) => {
+    rl.question(question, (answer) => {
+      rl.close();
+      resolve2(isAffirmative(answer));
+    });
+  });
+}
+async function recoverOldNode(opts) {
+  const existing = vendoredNode();
+  if (existsSync2(existing) && majorOf2(existing) >= NODE_MAJOR) {
+    return reexec(existing, opts.cliPath);
+  }
+  if (!opts.offerDownload) return { handled: false };
+  if (process.platform === "win32") return { handled: false };
+  const forced = process.env[VENDOR_ENV]?.trim();
+  if (forced === "0") return { handled: false };
+  if (forced !== "1") {
+    if (!process.stdin.isTTY) return { handled: false };
+    const yes = await ask(
+      `
+Openship can download its own Node ${NODE_MAJOR} (~50 MB) into ${OS_DIR}/runtime
+and use it for Openship only \u2014 your system Node is left exactly as it is.
+
+Download it now? [Y/n] `
+    );
+    if (!yes) return { handled: false };
+  }
+  let nodeBin;
+  try {
+    nodeBin = (await ensureNodeRuntime(opts.log)).node;
+  } catch (e) {
+    opts.log(`Could not set up Node ${NODE_MAJOR}: ${e.message}`);
+    return { handled: false };
+  }
+  if (nodeBin === "node") return { handled: false };
+  opts.log(`Using Node ${NODE_MAJOR} from ${OS_DIR}/runtime \u2014 future runs pick it up automatically.`);
+  return reexec(nodeBin, opts.cliPath);
+}
+export {
+  NODE_REEXEC_ENV,
+  isAffirmative,
+  recoverOldNode
+};

package/dist/node-entry.js

@@ -1,4 +1,55 @@
 #!/usr/bin/env node
 
 // src/node-entry.ts
-import "./index.js";
+import { fileURLToPath } from "url";
+var HARD_FLOOR = 20;
+var SUPPORTED = 22;
+var INSTALLER = "curl -fsSL https://get.openship.io | sh";
+var CLI_PATH = fileURLToPath(new URL("./index.js", import.meta.url));
+var log = (msg) => process.stderr.write(`${msg}
+`);
+var runningBun = typeof process.versions.bun === "string";
+var major = Number.parseInt(process.versions.node?.split(".")[0] ?? "", 10);
+var reexeced = process.env.OPENSHIP_NODE_REEXEC === "1";
+var tooOld = !runningBun && !reexeced && Number.isFinite(major) && major < SUPPORTED;
+if (tooOld) {
+  try {
+    const { recoverOldNode } = await import("./node-bootstrap.js");
+    const outcome = await recoverOldNode({
+      cliPath: CLI_PATH,
+      // 20 and 21 DO run: reuse a Node already on disk, but don't prompt to download
+      // one on every invocation to fix a setup that already works.
+      offerDownload: major < HARD_FLOOR,
+      log
+    });
+    if (outcome.handled) process.exit(outcome.status ?? 0);
+  } catch {
+  }
+  if (major < HARD_FLOOR) {
+    process.stderr.write(
+      `
+Openship needs Node ${SUPPORTED} or newer \u2014 this is Node v${process.versions.node}.
+
+  Install Node ${SUPPORTED}+ and re-run, or use the official installer, which
+  brings its own Node and doesn't touch the one you have:
+
+    ${INSTALLER}
+
+  Non-interactive (CI, a service)? Set OPENSHIP_VENDOR_NODE=1 and Openship
+  fetches its own Node ${SUPPORTED} without asking.
+
+If you upgrade Node with a version manager (nvm, fnm, volta), global packages
+live per Node version \u2014 reinstall the CLI afterwards or the command will go
+missing: npm i -g openship
+
+`
+    );
+    process.exit(1);
+  }
+  process.stderr.write(
+    `Warning: Node v${process.versions.node} is below Openship's supported floor (Node ${SUPPORTED}+). It may work; it isn't tested. Upgrade, or install with:
+  ${INSTALLER}
+`
+  );
+}
+await import("./index.js");

package/dist/{openresty-lua-WGBO2M3Z.js → openresty-lua-ATTH35BE.js}

@@ -10,6 +10,7 @@ import {
   EDGE_CHALLENGE_LOCATION,
   EDGE_CHALLENGE_ROOT,
   EDGE_CHALLENGE_URL_PREFIX,
+  EDGE_CLIENT_MAX_BODY_SIZE,
   EDGE_CONTAINER_MOUNTS,
   EDGE_DEFAULT_CERT_CN,
   EDGE_DEFAULT_CERT_DIRNAME,
@@ -18,6 +19,7 @@ import {
   EDGE_HTTPS_REJECT_BLOCK,
   EDGE_LUA_PACKAGE_PATH,
   EDGE_MGMT_SERVER_BLOCK,
+  EDGE_SAME_PATH_MOUNTS,
   EDGE_SERVER_NAMES_HASH_BUCKET_SIZE,
   EDGE_SHARED_DICTS,
   GEOIP_DB_PATH,
@@ -38,9 +40,11 @@ import {
   ensureOpenRestyConfig,
   luaSourceAvailable,
   parseNginxVersion
-} from "./chunk-YIPMDGG6.js";
+} from "./chunk-RSR7PFIQ.js";
+import "./chunk-YMMQRE5J.js";
+import "./chunk-UVNMQM7W.js";
 import "./chunk-ZFJXPCQP.js";
-import "./chunk-OTLSJYAC.js";
+import "./chunk-UJ6JZM65.js";
 import "./chunk-PXKCZB2I.js";
 export {
   ACME_CHALLENGE_LOCATION,
@@ -50,6 +54,7 @@ export {
   EDGE_CHALLENGE_LOCATION,
   EDGE_CHALLENGE_ROOT,
   EDGE_CHALLENGE_URL_PREFIX,
+  EDGE_CLIENT_MAX_BODY_SIZE,
   EDGE_CONTAINER_MOUNTS,
   EDGE_DEFAULT_CERT_CN,
   EDGE_DEFAULT_CERT_DIRNAME,
@@ -58,6 +63,7 @@ export {
   EDGE_HTTPS_REJECT_BLOCK,
   EDGE_LUA_PACKAGE_PATH,
   EDGE_MGMT_SERVER_BLOCK,
+  EDGE_SAME_PATH_MOUNTS,
   EDGE_SERVER_NAMES_HASH_BUCKET_SIZE,
   EDGE_SHARED_DICTS,
   GEOIP_DB_PATH,

package/dist/privilege-I4W3ZNZK.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  privilegedExecutor,
+  rootChecked,
+  rootOrDegrade
+} from "./chunk-4I2BM2DT.js";
+import "./chunk-YMMQRE5J.js";
+import "./chunk-UVNMQM7W.js";
+import "./chunk-ZFJXPCQP.js";
+import "./chunk-UJ6JZM65.js";
+import "./chunk-PXKCZB2I.js";
+export {
+  privilegedExecutor,
+  rootChecked,
+  rootOrDegrade
+};

package/dist/server/engine/samples/amavisd/amavisd.conf

@@ -477,6 +477,31 @@ $bad_header_quarantine_to = 'bad-header-quarantine';
 #$undecipherable_subject_tag = '***UNCHECKED*** ';  # undef disables it
 $undecipherable_subject_tag = undef;
 
+# ─── What happens when NO virus scanner can be reached (GH-565) ──────────────
+#
+# With the settings above and @av_scanners_backup = () earlier in this file, a
+# message that no scanner could examine is DELIVERED, with no subject tag and no
+# admin notification. That is amavis' default and it is a deliberate choice here:
+# clamd's signature load is memory-hungry and its socket is the most fragile part
+# of the stack, so failing OPEN keeps mail flowing on small VPSes.
+#
+# It is a real trade-off, so know which side you are on. Note that amavis still
+# adds its `X-Virus-Scanned` header on this path — the header records that amavis
+# processed the message, NOT that a scanner passed it, and it must not be read as
+# proof of a clean scan. The Emails → Health tab is the honest signal: it reports
+# ClamAV as Crashed/Failed and says mail is being delivered without scanning.
+#
+# To fail CLOSED instead — mail queues (4xx tempfail) until a scanner is back,
+# rather than arriving unscanned — uncomment ONE of these:
+#
+#   $virus_scanners_failure_is_fatal = 1;   # scanner failure => tempfail
+#   $final_unchecked_destiny = D_TEMPFAIL;  # same, via the destiny table
+#
+# Before you do: while clamd is down this defers EVERY inbound message, and a
+# queue that outlives the sender's retry window loses mail. Pair it with the
+# subject tag above if you would rather label than defer.
+# ─────────────────────────────────────────────────────────────────────────────
+
 # Hope to fix 'nested MAIL command' issue on high load server.
 $smtp_connection_cache_enable = 0;
 

package/dist/server/engine/samples/fail2ban/jail.d/sshd.local

@@ -1,7 +1,10 @@
 [sshd]
 backend     = polling
 journalmatch=
-enabled     = true
+# openship-mail runs no sshd (SSH is on the host, not in the mail container), so
+# there is no /var/log/auth.log for this jail to tail — leaving it enabled makes
+# fail2ban crash-loop on a missing logpath. Disabled for the containerized engine.
+enabled     = false
 filter      = sshd
 logpath     = PH_SSHD_LOGFILE tail
 action      = PH_FAIL2BAN_ACTION[name=sshd, port="PH_SSHD_PORT", protocol=tcp]

package/dist/server/engine/samples/postfix/master.cf

@@ -24,12 +24,26 @@ mlmmj   unix  -       n       n       -       -       pipe
     flags=ORhu user=PH_SYS_USER_MLMMJ:PH_SYS_GROUP_MLMMJ argv=PH_CMD_MLMMJ_AMIME_RECEIVE -L PH_MLMMJ_SPOOL_DIR/${nexthop}
 
 # Amavisd integration.
+#
+# smtp_tls_security_level=none is REQUIRED, not an optimisation (GH-392). This
+# is an smtp CLIENT service, so it inherits the global smtp_tls_security_level
+# — and amavisd's :10024 listener does not offer STARTTLS. With the global set
+# to `encrypt` every inbound message defers with "TLS is required, but was not
+# offered": a complete INBOUND outage, from a setting that only looks like it
+# concerns outbound delivery. Saving an outbound relay with scope "all" sets
+# exactly that (apps/api/src/modules/mail/admin/outbound-relay.service.ts), and
+# so does an operator hardening TLS by hand.
+#
+# TLS here would be meaningless anyway: the hop is loopback to a content filter
+# on the same host. Pinning it at the transport keeps the guarantee local to the
+# thing that needs it, instead of depending on every writer of the global.
 smtp-amavis unix -  -   n   -   PH_AMAVISD_MAX_SERVERS  smtp
     -o syslog_name=postfix/amavis
     -o local_header_rewrite_clients=
     -o smtp_data_done_timeout=1200
     -o smtp_send_xforward_command=yes
     -o smtp_dns_support_level=disabled
+    -o smtp_tls_security_level=none
     -o max_use=20
 
 # smtp port used by Amavisd to re-inject scanned email back to Postfix