openship 0.6.5 → 0.6.6

package/dist/index.js

@@ -7,18 +7,13 @@ import {
   RELEASES,
   RELEASES_DIR,
   assetUrl,
-  bootstrapAdmin,
-  detectPublicIp,
   downloadToFile,
   ensureDashboard,
-  ensureInternalToken,
   expectedSha256,
   fetchSidecar,
   formatBytes,
   hashFile,
   headlessProvision,
-  internalGet,
-  internalPost,
   normalizeUrl,
   parseSha256,
   readCliInstall,
@@ -30,24 +25,8 @@ import {
   startService,
   stop,
   upCommand,
-  waitDashboard,
-  waitHealthy,
   writeCliInstall
-} from "./chunk-7S4USQYF.js";
-import {
-  importMigratedSites
-} from "./chunk-6HOA5JT7.js";
-import {
-  completeHostEdge,
-  confirmEdgeAction,
-  diagnoseEdge,
-  planAndApplyHostEdge,
-  remediateUnreachableStaticRoots,
-  renderEdgeConflict,
-  repairEdgeConflict,
-  rollbackHostEdge
-} from "./chunk-HPXP6LXZ.js";
-import "./chunk-XRNRT37W.js";
+} from "./chunk-NK5N5LXN.js";
 import {
   composeDown,
   composeInternalToken,
@@ -79,16 +58,40 @@ import {
   saveInstanceUrl,
   shortSha,
   sourceBuildDir,
-  startUnitHint,
   storedApiPort,
   storedDashboardPort
-} from "./chunk-QLX7NBEA.js";
+} from "./chunk-WVAML4H6.js";
+import {
+  bootstrapAdmin,
+  detectPublicIp,
+  importMigratedSites,
+  internalFetch,
+  internalGet,
+  internalPost,
+  internalTokenRejectedProblem,
+  waitDashboard,
+  waitHealthy
+} from "./chunk-VTGPEC6B.js";
+import {
+  startUnitHint
+} from "./chunk-5DMWSTOM.js";
 import "./chunk-QWHBRY2K.js";
+import {
+  completeHostEdge,
+  confirmEdgeAction,
+  diagnoseEdge,
+  planAndApplyHostEdge,
+  remediateUnreachableStaticRoots,
+  renderEdgeConflict,
+  repairEdgeConflict,
+  rollbackHostEdge
+} from "./chunk-CBLD2HS5.js";
 import {
   DATA_DIR,
   LOG_DIR,
   OS_DIR
 } from "./chunk-ELGRMZOW.js";
+import "./chunk-HKRQXPTI.js";
 import "./chunk-ONKEYSMY.js";
 import "./chunk-XZYFZ6A5.js";
 import "./chunk-PDW4L3NV.js";
@@ -97,37 +100,38 @@ import "./chunk-42WQABXM.js";
 import "./chunk-DRK3MEDS.js";
 import "./chunk-3NQQXMDR.js";
 import "./chunk-ZWLDLTJP.js";
-import "./chunk-6JELW75A.js";
-import "./chunk-3ZAGC5NT.js";
-import "./chunk-WNWQBB7F.js";
-import "./chunk-2GWYYHOR.js";
-import "./chunk-RXQBD4ZY.js";
-import "./chunk-XVOBL7BC.js";
+import "./chunk-FE7ZZQSE.js";
+import "./chunk-OBPKYXQL.js";
 import {
   detectInstalledProxy,
   scanImportableSites
-} from "./chunk-7334NSJL.js";
-import "./chunk-VLQ3UIVO.js";
+} from "./chunk-A4GXYE4L.js";
+import "./chunk-QVW76WDL.js";
+import "./chunk-RSR7PFIQ.js";
 import "./chunk-I3DPMTSF.js";
-import "./chunk-VDESJSG6.js";
-import "./chunk-LFCSC4IU.js";
-import "./chunk-GRTXMUHA.js";
-import "./chunk-MSZUCNPV.js";
-import "./chunk-TM2IQPYU.js";
-import "./chunk-VHMOQL5Y.js";
-import "./chunk-5OUWIPOB.js";
+import "./chunk-WNWQBB7F.js";
+import "./chunk-2GWYYHOR.js";
+import "./chunk-RXQBD4ZY.js";
+import "./chunk-77QDF6UD.js";
+import "./chunk-LUKYPVJ4.js";
+import "./chunk-LFE5KQ7Y.js";
+import "./chunk-YIMOCZBZ.js";
+import "./chunk-LH2PLRQO.js";
+import "./chunk-MLYSEZQB.js";
+import "./chunk-Q7WGTQQ5.js";
+import "./chunk-PCPVTH6M.js";
 import {
   LocalExecutor
 } from "./chunk-6FH4AXVY.js";
-import "./chunk-RFWJE7ZN.js";
-import "./chunk-WE7BXW6L.js";
-import "./chunk-A7EWM2KA.js";
-import "./chunk-PZRRL5PC.js";
-import "./chunk-EZPPTWJQ.js";
-import "./chunk-WFRXYWK2.js";
+import "./chunk-4I2BM2DT.js";
+import "./chunk-YMMQRE5J.js";
+import "./chunk-UVNMQM7W.js";
 import "./chunk-ZFJXPCQP.js";
+import "./chunk-2YM3NI2E.js";
+import "./chunk-SM26HDS2.js";
 import {
   CLOUD_DASHBOARD_URL,
+  HOST_CHANNEL_AUTH_REJECTED_SHORT,
   HOST_CHANNEL_PROVISION_COMMAND,
   LOCAL_API_URL,
   LOCAL_DASHBOARD_URL,
@@ -142,7 +146,7 @@ import {
   parseOpenshipConfigJson,
   resolveCliUpdatePlan,
   summarizeHostChannelCause
-} from "./chunk-LEYSL46B.js";
+} from "./chunk-UJ6JZM65.js";
 import "./chunk-PXKCZB2I.js";
 
 // src/index.ts
@@ -301,7 +305,7 @@ function getDashboardUrl(name) {
 }
 
 // src/lib/api-client.ts
-var USER_AGENT = `openship-cli/${true ? "0.6.5" : "dev"}`;
+var USER_AGENT = `openship-cli/${true ? "0.6.6" : "dev"}`;
 function getApiUrl2() {
   return `${getApiUrl()}/api`;
 }
@@ -1008,16 +1012,11 @@ function ensure(value) {
   return value;
 }
 async function internalGet2(path2, timeoutMs = 8e3) {
-  try {
-    const res = await fetch(`http://127.0.0.1:${storedApiPort()}${path2}`, {
-      headers: { "X-Internal-Token": ensureInternalToken() },
-      signal: AbortSignal.timeout(timeoutMs)
-    });
-    if (!res.ok) return null;
-    return await res.json();
-  } catch {
-    return null;
-  }
+  const call = await internalFetch(String(storedApiPort()), path2, {
+    signal: AbortSignal.timeout(timeoutMs)
+  });
+  if (call.kind !== "response" || !call.res.ok) return null;
+  return await call.res.json().catch(() => null);
 }
 async function apiReachable() {
   try {
@@ -1102,7 +1101,7 @@ function dockerNameRunning(nameFilter) {
   return r.stdout.trim().length > 0;
 }
 async function hostControlCheck(api) {
-  const { checkHostChannel } = await import("./host-channel-preflight-MUXE3KZU.js");
+  const { checkHostChannel } = await import("./host-channel-preflight-KE6OONYK.js");
   return hostControlRow(await checkHostChannel().catch(() => null), api);
 }
 var NEVER_PROVISIONED_DETAIL = `never provisioned \u2014 run \`${HOST_CHANNEL_PROVISION_COMMAND}\``;
@@ -1127,6 +1126,11 @@ function hostControlRow(res, api) {
       case "key_unreadable":
       case "unreachable":
         return row2("fail", `${api.state.replace(/_/g, " ")} \u2014 see the api container's boot log`);
+      // Its own case, NOT grouped above: this is the one fault here an operator can act
+      // on without the withheld address, and #527 is what happens when the only thing
+      // we tell them is to go read a log.
+      case "auth_rejected":
+        return row2("fail", HOST_CHANNEL_AUTH_REJECTED_SHORT);
       // `disabled` (a hardening choice) and `not_applicable` (a bare install) are the
       // same non-event the local path returns null for. Whitelisted rather than derived
       // from `ok === false`, which `disabled` also is.
@@ -1502,7 +1506,7 @@ async function interactiveDoctor() {
       continue;
     }
     if (action2 === "host-control") {
-      const { verifyHostChannel } = await import("./host-channel-preflight-MUXE3KZU.js");
+      const { verifyHostChannel } = await import("./host-channel-preflight-KE6OONYK.js");
       const report3 = await verifyHostChannel().catch(() => null);
       if (report3?.status === "fixed") log2.success("Host control is reachable now.");
       else if (report3?.status === "ok") log2.success("Host control was already reachable.");
@@ -3459,7 +3463,7 @@ async function runRepair2(mode) {
   requireLinux();
   const sp = spin2(mode === "migrate" ? "Migrating the existing proxy's sites into the edge\u2026" : "Taking over :80/:443\u2026");
   try {
-    const { repairEdgeConflict: repairEdgeConflict2 } = await import("./edge-preflight-ES6FH4JK.js");
+    const { repairEdgeConflict: repairEdgeConflict2 } = await import("./edge-preflight-GBNCPNVU.js");
     sp?.stop();
     const res = await repairEdgeConflict2(mode, apiPort(), onLog);
     reportRepair(res);
@@ -3608,7 +3612,7 @@ async function panelStatus() {
 async function panelRepair(mode) {
   const sp = spin2(mode === "migrate" ? "Migrating the existing proxy's sites\u2026" : "Taking over :80/:443\u2026");
   try {
-    const { repairEdgeConflict: repairEdgeConflict2 } = await import("./edge-preflight-ES6FH4JK.js");
+    const { repairEdgeConflict: repairEdgeConflict2 } = await import("./edge-preflight-GBNCPNVU.js");
     sp?.stop();
     const res = await repairEdgeConflict2(mode, apiPort(), onLog);
     renderRepair(res);
@@ -4450,7 +4454,7 @@ function printMonitoringNextSteps() {
   info("    openship edge analytics -p <project>            per-domain analytics");
 }
 async function runMonitoringInstall(opts) {
-  const up = await import("./up-XEO3SR6Z.js");
+  const up = await import("./up-K4BV7466.js");
   let adminName = opts.adminName;
   let adminEmail = opts.adminEmail;
   let adminPassword = opts.adminPassword;
@@ -6152,21 +6156,26 @@ var resetAdminCommand = new Command24("reset-admin-password").description("Reset
     pw = entered;
   }
   const port = String(opts.port || storedApiPort());
-  let res;
-  try {
-    res = await fetch(`http://127.0.0.1:${port}/api/system/reset-admin-password`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json", "X-Internal-Token": ensureInternalToken() },
-      body: JSON.stringify({ password: pw, email: opts.email, name: opts.name })
-    });
-  } catch {
+  const call = await internalFetch(port, "/api/system/reset-admin-password", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ password: pw, email: opts.email, name: opts.name })
+  });
+  if (call.kind === "unreachable") {
     log4.error(`Couldn't reach the Openship API on port ${port}. Is it running? (openship status)`);
     log4.info("If it's listening on another port, pass --port <n>.");
     process.exit(1);
   }
+  if (call.kind === "no-token") {
+    log4.error(`Reset failed \u2014 ${call.detail}`);
+    process.exit(1);
+  }
+  const res = call.res;
   const data = await res.json().catch(() => ({}));
   if (!res.ok || !data.ok) {
-    log4.error(`Reset failed: ${data.error || res.statusText}`);
+    log4.error(
+      `Reset failed: ${call.tokenRejected ? internalTokenRejectedProblem() : data.error || res.statusText}`
+    );
     process.exit(1);
   }
   outro3(chalk18.green(`Password reset. Log in as ${data.email} with your new password.`));
@@ -6602,7 +6611,7 @@ function applyOnlyArgv(selfArgs, json) {
 // src/commands/update.ts
 async function verifyHostChannelAfterUpdate() {
   if (isJsonMode()) return;
-  const { verifyHostChannel } = await import("./host-channel-preflight-MUXE3KZU.js");
+  const { verifyHostChannel } = await import("./host-channel-preflight-KE6OONYK.js");
   await verifyHostChannel().catch(() => {
   });
 }
@@ -6679,7 +6688,7 @@ async function runSourceUpdate(source, opts) {
 }
 var REINSTALL_HINT = "curl -fsSL https://get.openship.io | sh";
 async function runTarballUpdate(install, opts) {
-  const current = "0.6.5";
+  const current = "0.6.6";
   let latest;
   try {
     latest = (await resolveLatestTag()).replace(/^v/, "");
@@ -6763,7 +6772,7 @@ var updateCommand = new Command26("update").description("Update the Openship CLI
   if (source) return runSourceUpdate(source, opts);
   const cliInstall = readCliInstall();
   if (cliInstall?.method === "tarball") return runTarballUpdate(cliInstall, opts);
-  const current = "0.6.5";
+  const current = "0.6.6";
   let latest;
   try {
     latest = (await resolveLatestTag()).replace(/^v/, "");
@@ -7023,10 +7032,11 @@ async function streamProvision(port, sessionId, s) {
   let ok3 = false;
   let detail;
   try {
-    const res = await fetch(`http://127.0.0.1:${port}/api/system/self-register/stream?id=${sessionId}`, {
-      headers: { "X-Internal-Token": ensureInternalToken() },
+    const call = await internalFetch(port, `/api/system/self-register/stream?id=${sessionId}`, {
       signal: AbortSignal.timeout(3e5)
     });
+    if (call.kind !== "response") return { ok: false, detail: call.detail };
+    const res = call.res;
     if (!res.ok || !res.body) return { ok: false };
     const reader = res.body.getReader();
     const decoder = new TextDecoder();
@@ -7370,7 +7380,7 @@ async function runWizard() {
       }
     }
   }
-  const uiTag = `v${"0.6.5"}`;
+  const uiTag = `v${"0.6.6"}`;
   if (method === "bare") {
     const dl = spinner4();
     dl.start("Pulling the Openship dist from GitHub");
@@ -7430,7 +7440,7 @@ async function runWizard() {
     const dashboardPort = String(ports.dashboard);
     const moved = portMoveNotice(ports, composeTrustedOriginUrls());
     if (moved.length) log5.info(moved.join("\n"));
-    if (!pinnedImagesReady({ version: "0.6.5" })) {
+    if (!pinnedImagesReady({ version: "0.6.6" })) {
       cancel4("The pinned Openship image tag isn't in the registry yet \u2014 nothing on this box was changed.");
       process.exit(1);
     }
@@ -7454,7 +7464,7 @@ async function runWizard() {
       dashboardPort,
       publicUrl,
       trustProxy: behindProxy,
-      version: "0.6.5",
+      version: "0.6.6",
       noHostControl: !allowHostControl
     });
     if (!fetched.ok) {
@@ -7483,7 +7493,7 @@ async function runWizard() {
       dashboardPort,
       publicUrl,
       trustProxy: behindProxy,
-      version: "0.6.5",
+      version: "0.6.6",
       noHostControl: !allowHostControl
     });
     if (!up.ok) {
@@ -7538,9 +7548,10 @@ async function runWizard() {
         migratedCertPems,
         migratedStaticRootOverrides
       );
-      if (!imported.ok) {
+      const missed = migratedSites.length - imported.registered.length;
+      if (missed > 0) {
         log5.warn(
-          `Your ${migratedSites.length} existing site${migratedSites.length === 1 ? "" : "s"} aren't served yet \u2014 re-run \`openship up\` to retry the import.`
+          `${missed} of your ${migratedSites.length} existing site${migratedSites.length === 1 ? "" : "s"} ${missed === 1 ? "isn't" : "aren't"} served yet \u2014 see the import output above.`
         );
       }
     }
@@ -7583,7 +7594,7 @@ async function runWizard() {
     if (result.liveUrl) liveUrl2 = result.liveUrl;
     else if (!result.domainRegistered) liveUrl2 = `http://localhost:${started.dashPort}`;
     for (const w of result.warnings) log5.warn(w);
-    const { verifyHostChannel } = await import("./host-channel-preflight-MUXE3KZU.js");
+    const { verifyHostChannel } = await import("./host-channel-preflight-KE6OONYK.js");
     await verifyHostChannel().catch(() => {
     });
     finishSetup({
@@ -7862,7 +7873,7 @@ function attachCompletion(program2) {
 
 // src/index.ts
 var program = new Command28();
-program.name("openship").description("Openship CLI \u2014 install, run, and manage Openship from your terminal").version("0.6.5").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
+program.name("openship").description("Openship CLI \u2014 install, run, and manage Openship from your terminal").version("0.6.6").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
   if (thisCommand.opts().json) setJsonMode(true);
 }).action(async () => {
   const installed = serviceStatus().installed || readInstallMethod() === "compose";

package/dist/{nginx-NSAHWGJV.js → nginx-KUFMLMAC.js}

@@ -8,20 +8,21 @@ import {
   VHOST_GENERATION,
   acmeKeyArgs,
   assertValidChallengeToken,
+  isAcmePortBindFailure,
   readVhostGeneration,
   renderGeoEntries,
   renderProxyOptions,
   renderProxyTlsOptions,
   summarizeCertbotFailure
-} from "./chunk-VLQ3UIVO.js";
+} from "./chunk-QVW76WDL.js";
+import "./chunk-RSR7PFIQ.js";
 import "./chunk-I3DPMTSF.js";
-import "./chunk-WE7BXW6L.js";
-import "./chunk-A7EWM2KA.js";
-import "./chunk-PZRRL5PC.js";
-import "./chunk-EZPPTWJQ.js";
-import "./chunk-WFRXYWK2.js";
+import "./chunk-YMMQRE5J.js";
+import "./chunk-UVNMQM7W.js";
 import "./chunk-ZFJXPCQP.js";
-import "./chunk-LEYSL46B.js";
+import "./chunk-2YM3NI2E.js";
+import "./chunk-SM26HDS2.js";
+import "./chunk-UJ6JZM65.js";
 import "./chunk-PXKCZB2I.js";
 export {
   MANAGED_STATIC_BASE,
@@ -29,6 +30,7 @@ export {
   VHOST_GENERATION,
   acmeKeyArgs,
   assertValidChallengeToken,
+  isAcmePortBindFailure,
   readVhostGeneration,
   renderGeoEntries,
   renderProxyOptions,

package/dist/{openresty-lua-DR4D3EZ6.js → openresty-lua-ATTH35BE.js}

@@ -10,6 +10,7 @@ import {
   EDGE_CHALLENGE_LOCATION,
   EDGE_CHALLENGE_ROOT,
   EDGE_CHALLENGE_URL_PREFIX,
+  EDGE_CLIENT_MAX_BODY_SIZE,
   EDGE_CONTAINER_MOUNTS,
   EDGE_DEFAULT_CERT_CN,
   EDGE_DEFAULT_CERT_DIRNAME,
@@ -39,11 +40,11 @@ import {
   ensureOpenRestyConfig,
   luaSourceAvailable,
   parseNginxVersion
-} from "./chunk-PZRRL5PC.js";
-import "./chunk-EZPPTWJQ.js";
-import "./chunk-WFRXYWK2.js";
+} from "./chunk-RSR7PFIQ.js";
+import "./chunk-YMMQRE5J.js";
+import "./chunk-UVNMQM7W.js";
 import "./chunk-ZFJXPCQP.js";
-import "./chunk-LEYSL46B.js";
+import "./chunk-UJ6JZM65.js";
 import "./chunk-PXKCZB2I.js";
 export {
   ACME_CHALLENGE_LOCATION,
@@ -53,6 +54,7 @@ export {
   EDGE_CHALLENGE_LOCATION,
   EDGE_CHALLENGE_ROOT,
   EDGE_CHALLENGE_URL_PREFIX,
+  EDGE_CLIENT_MAX_BODY_SIZE,
   EDGE_CONTAINER_MOUNTS,
   EDGE_DEFAULT_CERT_CN,
   EDGE_DEFAULT_CERT_DIRNAME,

package/dist/{privilege-YTVI4SKF.js → privilege-I4W3ZNZK.js}

@@ -6,11 +6,11 @@ import {
   privilegedExecutor,
   rootChecked,
   rootOrDegrade
-} from "./chunk-RFWJE7ZN.js";
-import "./chunk-EZPPTWJQ.js";
-import "./chunk-WFRXYWK2.js";
+} from "./chunk-4I2BM2DT.js";
+import "./chunk-YMMQRE5J.js";
+import "./chunk-UVNMQM7W.js";
 import "./chunk-ZFJXPCQP.js";
-import "./chunk-LEYSL46B.js";
+import "./chunk-UJ6JZM65.js";
 import "./chunk-PXKCZB2I.js";
 export {
   privilegedExecutor,

package/dist/server/engine/samples/amavisd/amavisd.conf

@@ -477,6 +477,31 @@ $bad_header_quarantine_to = 'bad-header-quarantine';
 #$undecipherable_subject_tag = '***UNCHECKED*** ';  # undef disables it
 $undecipherable_subject_tag = undef;
 
+# ─── What happens when NO virus scanner can be reached (GH-565) ──────────────
+#
+# With the settings above and @av_scanners_backup = () earlier in this file, a
+# message that no scanner could examine is DELIVERED, with no subject tag and no
+# admin notification. That is amavis' default and it is a deliberate choice here:
+# clamd's signature load is memory-hungry and its socket is the most fragile part
+# of the stack, so failing OPEN keeps mail flowing on small VPSes.
+#
+# It is a real trade-off, so know which side you are on. Note that amavis still
+# adds its `X-Virus-Scanned` header on this path — the header records that amavis
+# processed the message, NOT that a scanner passed it, and it must not be read as
+# proof of a clean scan. The Emails → Health tab is the honest signal: it reports
+# ClamAV as Crashed/Failed and says mail is being delivered without scanning.
+#
+# To fail CLOSED instead — mail queues (4xx tempfail) until a scanner is back,
+# rather than arriving unscanned — uncomment ONE of these:
+#
+#   $virus_scanners_failure_is_fatal = 1;   # scanner failure => tempfail
+#   $final_unchecked_destiny = D_TEMPFAIL;  # same, via the destiny table
+#
+# Before you do: while clamd is down this defers EVERY inbound message, and a
+# queue that outlives the sender's retry window loses mail. Pair it with the
+# subject tag above if you would rather label than defer.
+# ─────────────────────────────────────────────────────────────────────────────
+
 # Hope to fix 'nested MAIL command' issue on high load server.
 $smtp_connection_cache_enable = 0;
 

package/dist/server/engine/samples/postfix/master.cf

@@ -24,12 +24,26 @@ mlmmj   unix  -       n       n       -       -       pipe
     flags=ORhu user=PH_SYS_USER_MLMMJ:PH_SYS_GROUP_MLMMJ argv=PH_CMD_MLMMJ_AMIME_RECEIVE -L PH_MLMMJ_SPOOL_DIR/${nexthop}
 
 # Amavisd integration.
+#
+# smtp_tls_security_level=none is REQUIRED, not an optimisation (GH-392). This
+# is an smtp CLIENT service, so it inherits the global smtp_tls_security_level
+# — and amavisd's :10024 listener does not offer STARTTLS. With the global set
+# to `encrypt` every inbound message defers with "TLS is required, but was not
+# offered": a complete INBOUND outage, from a setting that only looks like it
+# concerns outbound delivery. Saving an outbound relay with scope "all" sets
+# exactly that (apps/api/src/modules/mail/admin/outbound-relay.service.ts), and
+# so does an operator hardening TLS by hand.
+#
+# TLS here would be meaningless anyway: the hop is loopback to a content filter
+# on the same host. Pinning it at the transport keeps the guarantee local to the
+# thing that needs it, instead of depending on every writer of the global.
 smtp-amavis unix -  -   n   -   PH_AMAVISD_MAX_SERVERS  smtp
     -o syslog_name=postfix/amavis
     -o local_header_rewrite_clients=
     -o smtp_data_done_timeout=1200
     -o smtp_send_xforward_command=yes
     -o smtp_dns_support_level=disabled
+    -o smtp_tls_security_level=none
     -o max_use=20
 
 # smtp port used by Amavisd to re-inject scanned email back to Postfix