openship 0.6.5 → 0.6.6

package/dist/{chunk-WFRXYWK2.js → chunk-UVNMQM7W.js}

@@ -15,7 +15,7 @@ import {
   parseSystemOs,
   safeErrorMessage,
   systemDebug
-} from "./chunk-LEYSL46B.js";
+} from "./chunk-UJ6JZM65.js";
 
 // ../../packages/adapters/src/system/elevated-executor.ts
 import { randomBytes } from "crypto";

package/dist/chunk-VTGPEC6B.js

@@ -0,0 +1,308 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  COMPOSE_ENV_FILE,
+  composeInstallExists,
+  readComposeEnvFile,
+  startUnitHint
+} from "./chunk-5DMWSTOM.js";
+import {
+  INTERNAL_TOKEN_FILE,
+  OS_DIR
+} from "./chunk-ELGRMZOW.js";
+import {
+  LocalExecutor
+} from "./chunk-6FH4AXVY.js";
+import {
+  EDGE_CONTAINER_NAME,
+  edgeCrashReason
+} from "./chunk-2YM3NI2E.js";
+
+// src/lib/edge-import.ts
+import chalk from "chalk";
+import ora from "ora";
+
+// src/lib/internal-token.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { randomBytes } from "crypto";
+function mintBareInternalToken() {
+  if (existsSync(INTERNAL_TOKEN_FILE)) return readFileSync(INTERNAL_TOKEN_FILE, "utf8").trim();
+  mkdirSync(OS_DIR, { recursive: true, mode: 448 });
+  const token = randomBytes(32).toString("hex");
+  writeFileSync(INTERNAL_TOKEN_FILE, token, { mode: 384 });
+  return token;
+}
+function bareInternalToken() {
+  try {
+    return readFileSync(INTERNAL_TOKEN_FILE, "utf8").trim() || null;
+  } catch {
+    return null;
+  }
+}
+function internalTokenSources() {
+  const tokens = [];
+  const problems = [];
+  if (composeInstallExists()) {
+    const { env, unreadable } = readComposeEnvFile();
+    const composeToken = env.INTERNAL_TOKEN?.trim();
+    if (composeToken) {
+      tokens.push(composeToken);
+    } else if (unreadable) {
+      problems.push(
+        `can't read ${COMPOSE_ENV_FILE} (${unreadable}) \u2014 that file holds the running stack's token, so re-run this command with sudo`
+      );
+    } else {
+      problems.push(
+        `${COMPOSE_ENV_FILE} has no INTERNAL_TOKEN \u2014 re-run \`openship up\` to regenerate it`
+      );
+    }
+  }
+  const bare = bareInternalToken();
+  if (bare && !tokens.includes(bare)) tokens.push(bare);
+  return { tokens, problems };
+}
+function resolveInternalToken() {
+  return internalTokenSources().tokens[0] ?? null;
+}
+function internalTokenProblem() {
+  const { problems } = internalTokenSources();
+  if (problems.length) return problems.join("; ");
+  return `no internal token found on this machine (looked in ${COMPOSE_ENV_FILE} and ${INTERNAL_TOKEN_FILE}) \u2014 run \`openship up\` on this box first`;
+}
+function internalTokenRejectedProblem() {
+  const { tokens, problems } = internalTokenSources();
+  const plural = tokens.length > 1 ? `both of this machine's internal tokens` : `this machine's internal token`;
+  const unreadable = problems.length ? `${problems.join("; ")}. ` : "";
+  return `${unreadable}the API rejected ${plural}. It's running with a different one \u2014 restart it (\`openship up\`) so it picks up the current token, or check that this port belongs to this install`;
+}
+
+// src/lib/loopback-api.ts
+function isInternalAuthRejection(body) {
+  try {
+    return JSON.parse(body).error === "Unauthorized";
+  } catch {
+    return false;
+  }
+}
+function replay(res, body) {
+  return new Response(body, { status: res.status, statusText: res.statusText, headers: res.headers });
+}
+async function internalFetch(port, path, init = {}, token) {
+  const candidates = token ? [token] : internalTokenSources().tokens;
+  if (candidates.length === 0) return { kind: "no-token", detail: internalTokenProblem() };
+  const url = `http://127.0.0.1:${port}${path}`;
+  let refused;
+  for (const candidate of candidates) {
+    let res;
+    try {
+      res = await fetch(url, {
+        ...init,
+        headers: {
+          ...init.headers,
+          "X-Internal-Token": candidate
+        }
+      });
+    } catch (err) {
+      return { kind: "unreachable", detail: err.message };
+    }
+    if (res.status !== 401) return { kind: "response", res };
+    const body = await res.text().catch(() => "");
+    if (!isInternalAuthRejection(body)) return { kind: "response", res: replay(res, body) };
+    refused = replay(res, body);
+  }
+  return { kind: "response", res: refused, tokenRejected: true };
+}
+async function internalGet(port, path, token) {
+  const call = await internalFetch(
+    port,
+    path,
+    { signal: AbortSignal.timeout(1e4) },
+    token
+  );
+  if (call.kind !== "response" || !call.res.ok) return null;
+  return await call.res.json().catch(() => null);
+}
+async function internalPost(port, path, body, token) {
+  const call = await internalFetch(
+    port,
+    path,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(3e4)
+    },
+    token
+  );
+  if (call.kind !== "response") return { ok: false, data: { error: call.detail } };
+  const data = await call.res.json().catch(() => ({}));
+  if (call.tokenRejected && !token) {
+    return { ok: false, data: { ...data, error: internalTokenRejectedProblem() } };
+  }
+  return { ok: call.res.ok, data };
+}
+async function bootstrapAdmin(apiPort, admin, token) {
+  const { ok, data } = await internalPost(apiPort, "/api/system/bootstrap-admin", admin, token);
+  if (ok) return { ok: true };
+  if (data?.error === "An admin account already exists") return { ok: true, message: "already-exists" };
+  return { ok: false, message: data?.error || "failed" };
+}
+async function waitHealthy(apiPort, seconds = 90) {
+  for (let i = 0; i < seconds; i++) {
+    await new Promise((r) => setTimeout(r, 1e3));
+    try {
+      await fetch(`http://127.0.0.1:${apiPort}/api/health`, { signal: AbortSignal.timeout(2e3) });
+      return true;
+    } catch {
+    }
+  }
+  return false;
+}
+async function waitDashboard(dashPort, seconds = 45) {
+  for (let i = 0; i < seconds; i++) {
+    await new Promise((r) => setTimeout(r, 1e3));
+    try {
+      const res = await fetch(`http://127.0.0.1:${dashPort}/`, {
+        redirect: "manual",
+        signal: AbortSignal.timeout(2e3)
+      });
+      if (res.status > 0) return true;
+    } catch {
+    }
+  }
+  return false;
+}
+async function detectPublicIp() {
+  for (const url of ["https://api.ipify.org", "https://ifconfig.me/ip"]) {
+    try {
+      const res = await fetch(url, { signal: AbortSignal.timeout(3e3) });
+      if (!res.ok) continue;
+      const ip = (await res.text()).trim();
+      if (/^[0-9.]+$/.test(ip) || ip.includes(":")) return ip;
+    } catch {
+    }
+  }
+  return null;
+}
+
+// src/lib/edge-import.ts
+async function waitForApiHealth(port, tries) {
+  for (let i = 0; i < tries; i++) {
+    try {
+      const r = await fetch(`http://127.0.0.1:${port}/api/health`, { signal: AbortSignal.timeout(2e3) });
+      if (r.ok) return true;
+    } catch {
+    }
+    await new Promise((r) => setTimeout(r, 1e3));
+  }
+  return false;
+}
+async function waitForEdgeRunning(tries) {
+  const exec = new LocalExecutor();
+  for (let i = 0; i < tries; i++) {
+    const out = await exec.exec(`docker inspect -f '{{.State.Running}}' ${EDGE_CONTAINER_NAME}`).catch(() => "");
+    if (out.trim() === "true") return true;
+    await new Promise((r) => setTimeout(r, 1e3));
+  }
+  return false;
+}
+async function importMigratedSites(apiPort, sites, certPems, staticRootOverrides) {
+  if (!resolveInternalToken()) {
+    const error = internalTokenProblem();
+    console.log(chalk.yellow(`  Skipping site import \u2014 ${error}. Re-run to retry.
+`));
+    return { ok: false, registered: [], error };
+  }
+  const spinner = ora(
+    `Importing ${sites.length} migrated site${sites.length === 1 ? "" : "s"} into the edge\u2026`
+  ).start();
+  if (!await waitForApiHealth(apiPort, 60)) {
+    const error = "API didn't become healthy in time";
+    spinner.warn(`${error} \u2014 migrated sites not imported. Re-run \`openship up\` to retry.`);
+    return { ok: false, registered: [], error };
+  }
+  if (!await waitForEdgeRunning(60)) {
+    const error = `the ${EDGE_CONTAINER_NAME} container isn't running yet`;
+    spinner.warn(`${error} \u2014 migrated sites not imported. Re-run \`openship up\` to retry.`);
+    return { ok: false, registered: [], error };
+  }
+  try {
+    const call = await internalFetch(apiPort, "/api/system/edge/import-sites", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ sites, certPems, staticRootOverrides }),
+      signal: AbortSignal.timeout(12e4)
+    });
+    if (call.kind !== "response") {
+      spinner.warn(`Site import failed: ${call.detail}. Re-run to retry.`);
+      return { ok: false, registered: [], error: call.detail };
+    }
+    const r = call.res;
+    const data = await r.json().catch(() => ({}));
+    if (!r.ok) {
+      const error = data.error ?? `HTTP ${r.status}`;
+      spinner.warn(`Site import failed: ${error}. Re-run to retry.`);
+      return { ok: false, registered: [], error };
+    }
+    const registered = data.registered ?? [];
+    const warnings = data.warnings ?? [];
+    const missed = sites.length - registered.length;
+    if (sites.length > 0 && registered.length === 0) {
+      spinner.fail(
+        `Migrated NONE of the ${sites.length} site${sites.length === 1 ? "" : "s"} \u2014 Openship holds :80/:443 and ${sites.length === 1 ? "that hostname is" : "those hostnames are"} NOT being served.`
+      );
+      for (const w of warnings.slice(0, 8)) console.log(chalk.red(`    \u2022 ${w}`));
+      const edgeLog = await edgeCrashReason(new LocalExecutor());
+      if (edgeLog) {
+        console.log(chalk.red(`
+  The edge container is not running. Its log says:`));
+        console.log(chalk.red(`    ${edgeLog}`));
+      }
+      const back = startUnitHint("nginx");
+      console.log(
+        chalk.yellow(
+          `
+  Retry the import with \`openship up\` once the cause above is fixed, or put your
+` + (back ? `  previous proxy back:  docker stop ${EDGE_CONTAINER_NAME} && ${back}
+` : `  previous proxy back by stopping ${EDGE_CONTAINER_NAME} and starting it the way
+  this host starts services.
+`)
+        )
+      );
+      return { ok: false, registered, error: warnings[0] ?? "no sites were registered" };
+    }
+    if (missed > 0) {
+      spinner.warn(
+        `Migrated ${registered.length}/${sites.length} sites \u2014 ${missed} not served (see below).`
+      );
+      for (const w of warnings.slice(0, 8)) console.log(chalk.yellow(`    \u2022 ${w}`));
+      return { ok: false, registered, error: `${missed} site(s) not registered` };
+    }
+    spinner.succeed(
+      `Migrated ${registered.length} site${registered.length === 1 ? "" : "s"} into Openship's edge.`
+    );
+    for (const w of warnings.slice(0, 8)) console.log(chalk.dim(`    \u2022 ${w}`));
+    return { ok: true, registered };
+  } catch (e) {
+    const error = e.message;
+    spinner.warn(`Site import failed: ${error}. Re-run to retry.`);
+    return { ok: false, registered: [], error };
+  }
+}
+
+export {
+  mintBareInternalToken,
+  internalTokenRejectedProblem,
+  internalFetch,
+  internalGet,
+  internalPost,
+  bootstrapAdmin,
+  waitHealthy,
+  waitDashboard,
+  detectPublicIp,
+  waitForApiHealth,
+  waitForEdgeRunning,
+  importMigratedSites
+};