openship 0.6.5 → 0.6.7

package/dist/{chunk-RFWJE7ZN.js → chunk-PVP4RGWT.js}

@@ -4,15 +4,15 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   hostRefusal
-} from "./chunk-EZPPTWJQ.js";
+} from "./chunk-BLEXTYRK.js";
 import {
   elevatedExecutor,
   resolveEnvironment
-} from "./chunk-WFRXYWK2.js";
+} from "./chunk-FZ6QCF6B.js";
 import {
   answered,
   refused
-} from "./chunk-LEYSL46B.js";
+} from "./chunk-2VSW6Q6C.js";
 
 // ../../packages/adapters/src/system/privilege.ts
 function rootChecked(executor, why) {

package/dist/{chunk-PZRRL5PC.js → chunk-QHMDCYZ3.js}

@@ -5,19 +5,19 @@ const require = __ospCreateRequire(import.meta.url);
 import {
   envOps,
   opScript
-} from "./chunk-EZPPTWJQ.js";
+} from "./chunk-BLEXTYRK.js";
 import {
   resolveEnvironment
-} from "./chunk-WFRXYWK2.js";
+} from "./chunk-FZ6QCF6B.js";
 import {
   sq
-} from "./chunk-ZFJXPCQP.js";
+} from "./chunk-H3WT3A6R.js";
 import {
   SYSTEM,
   answered,
   refused,
   safeErrorMessage
-} from "./chunk-LEYSL46B.js";
+} from "./chunk-2VSW6Q6C.js";
 
 // ../../packages/adapters/src/infra/openresty-lua.ts
 import { createHash, randomBytes } from "crypto";
@@ -248,6 +248,7 @@ var OPENRESTY_MGMT_PORT = 9145;
 var OPENRESTY_SITE_LUALIB = OPENRESTY_LUA_DIR.replace(/\/[^/]+$/, "");
 var EDGE_LUA_PACKAGE_PATH = `${OPENRESTY_SITE_LUALIB}/?.lua;;`;
 var EDGE_SERVER_NAMES_HASH_BUCKET_SIZE = 128;
+var EDGE_CLIENT_MAX_BODY_SIZE = "50m";
 var EDGE_SHARED_DICTS = [
   /** Analytics counters. */
   { name: "analytics", size: "256m" },
@@ -440,6 +441,12 @@ async function ensureOpenRestyConfig(executor, paths) {
       );
     }
   }
+  const hasBodySize = await executor.exec(`grep -qE '^[[:space:]]*client_max_body_size' ${paths.confPath}`).then(() => true).catch(() => false);
+  if (!hasBodySize) {
+    await executor.exec(
+      `sed -i '/http *{/a \\    client_max_body_size ${EDGE_CLIENT_MAX_BODY_SIZE};' ${paths.confPath}`
+    );
+  }
 }
 function MINIMAL_NGINX_CONF(confDir, sitesDir) {
   return `# Auto-generated by Openship - safe to extend
@@ -456,6 +463,9 @@ http {
     # \`nginx -t\` outright for any server_name past ~63 chars, refusing the reload
     # and wedging every route on the box, not just the long one.
     server_names_hash_bucket_size ${EDGE_SERVER_NAMES_HASH_BUCKET_SIZE};
+    # See EDGE_CLIENT_MAX_BODY_SIZE \u2014 nginx's 1 MB default 413s an upload before the app
+    # ever sees it. A project's own value overrides this (server beats http).
+    client_max_body_size ${EDGE_CLIENT_MAX_BODY_SIZE};
     include ${sitesDir}/*.conf;
 }
 `;
@@ -715,6 +725,7 @@ export {
   OPENRESTY_MGMT_PORT,
   EDGE_LUA_PACKAGE_PATH,
   EDGE_SERVER_NAMES_HASH_BUCKET_SIZE,
+  EDGE_CLIENT_MAX_BODY_SIZE,
   EDGE_SHARED_DICTS,
   parseNginxVersion,
   OPENRESTY_DEFAULT_PATHS,

package/dist/chunk-R4VDPFLS.js

@@ -0,0 +1,106 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+
+// ../../packages/adapters/src/system/reachability.ts
+import { connect } from "net";
+import { request } from "http";
+function classifyDialError(code) {
+  switch (code) {
+    case "ECONNREFUSED":
+    case "ECONNRESET":
+      return "refused";
+    case "ENOTFOUND":
+    case "EAI_AGAIN":
+      return "unresolved";
+    case "EHOSTUNREACH":
+    case "ENETUNREACH":
+    case "ENETDOWN":
+      return "no_route";
+    // The kernel's own connect timeout, i.e. our `timeout` reported for us.
+    case "ETIMEDOUT":
+      return "timeout";
+    default:
+      return "error";
+  }
+}
+function probeTcpDetailed(host, port, timeoutMs = 2500) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const done = (result, socket2) => {
+      if (settled) return;
+      settled = true;
+      try {
+        socket2?.destroy();
+      } catch {
+      }
+      resolve(result);
+    };
+    const socket = connect({ host, port });
+    socket.setTimeout(timeoutMs);
+    socket.once("connect", () => done({ ok: true }, socket));
+    socket.once(
+      "timeout",
+      () => done({ ok: false, reason: "timeout", message: `no response within ${timeoutMs}ms` }, socket)
+    );
+    socket.once("error", (err) => {
+      const errno = err;
+      done(
+        {
+          ok: false,
+          reason: classifyDialError(errno.code),
+          ...errno.code ? { code: errno.code } : {},
+          ...errno.message ? { message: errno.message } : {}
+        },
+        socket
+      );
+    });
+  });
+}
+function probeHostedHttp(opts) {
+  const { hostname, path = "/", port = 80, timeoutMs = 3e3 } = opts;
+  return new Promise((resolve) => {
+    let settled = false;
+    const done = (value) => {
+      if (settled) return;
+      settled = true;
+      resolve(value);
+    };
+    const req = request(
+      {
+        host: "127.0.0.1",
+        port,
+        path,
+        method: "GET",
+        timeout: timeoutMs,
+        // Claim https so the :80 block SERVES instead of answering our own
+        // HTTP→HTTPS redirect before the doc root is consulted — see the curl twin in
+        // output-exists.ts for why a 301 here read as a healthy site.
+        headers: { Host: hostname, "X-Forwarded-Proto": "https" }
+      },
+      (res) => {
+        const status = res.statusCode ?? 0;
+        res.resume();
+        done(
+          status > 0 ? { status, served: status >= 200 && status < 400 || status === 401 || status === 403 } : null
+        );
+      }
+    );
+    const fail = () => {
+      try {
+        req.destroy();
+      } catch {
+      }
+      done(null);
+    };
+    req.once("timeout", fail);
+    req.once("error", fail);
+    req.end();
+  });
+}
+
+export {
+  probeTcpDetailed,
+  probeHostedHttp
+};

package/dist/chunk-RDXT4BQB.js

@@ -0,0 +1,310 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  COMPOSE_ENV_FILE,
+  composeInstallExists,
+  readComposeEnvFile,
+  startUnitHint
+} from "./chunk-VQM6JHJB.js";
+import {
+  INTERNAL_TOKEN_FILE,
+  OS_DIR
+} from "./chunk-ELGRMZOW.js";
+import {
+  LocalExecutor
+} from "./chunk-E2X26PXR.js";
+import {
+  edgeCrashReason
+} from "./chunk-GIPJNNI5.js";
+import {
+  EDGE_CONTAINER_NAME
+} from "./chunk-UWEV6XTS.js";
+
+// src/lib/edge-import.ts
+import chalk from "chalk";
+import ora from "ora";
+
+// src/lib/internal-token.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { randomBytes } from "crypto";
+function mintBareInternalToken() {
+  if (existsSync(INTERNAL_TOKEN_FILE)) return readFileSync(INTERNAL_TOKEN_FILE, "utf8").trim();
+  mkdirSync(OS_DIR, { recursive: true, mode: 448 });
+  const token = randomBytes(32).toString("hex");
+  writeFileSync(INTERNAL_TOKEN_FILE, token, { mode: 384 });
+  return token;
+}
+function bareInternalToken() {
+  try {
+    return readFileSync(INTERNAL_TOKEN_FILE, "utf8").trim() || null;
+  } catch {
+    return null;
+  }
+}
+function internalTokenSources() {
+  const tokens = [];
+  const problems = [];
+  if (composeInstallExists()) {
+    const { env, unreadable } = readComposeEnvFile();
+    const composeToken = env.INTERNAL_TOKEN?.trim();
+    if (composeToken) {
+      tokens.push(composeToken);
+    } else if (unreadable) {
+      problems.push(
+        `can't read ${COMPOSE_ENV_FILE} (${unreadable}) \u2014 that file holds the running stack's token, so re-run this command with sudo`
+      );
+    } else {
+      problems.push(
+        `${COMPOSE_ENV_FILE} has no INTERNAL_TOKEN \u2014 re-run \`openship up\` to regenerate it`
+      );
+    }
+  }
+  const bare = bareInternalToken();
+  if (bare && !tokens.includes(bare)) tokens.push(bare);
+  return { tokens, problems };
+}
+function resolveInternalToken() {
+  return internalTokenSources().tokens[0] ?? null;
+}
+function internalTokenProblem() {
+  const { problems } = internalTokenSources();
+  if (problems.length) return problems.join("; ");
+  return `no internal token found on this machine (looked in ${COMPOSE_ENV_FILE} and ${INTERNAL_TOKEN_FILE}) \u2014 run \`openship up\` on this box first`;
+}
+function internalTokenRejectedProblem() {
+  const { tokens, problems } = internalTokenSources();
+  const plural = tokens.length > 1 ? `both of this machine's internal tokens` : `this machine's internal token`;
+  const unreadable = problems.length ? `${problems.join("; ")}. ` : "";
+  return `${unreadable}the API rejected ${plural}. It's running with a different one \u2014 restart it (\`openship up\`) so it picks up the current token, or check that this port belongs to this install`;
+}
+
+// src/lib/loopback-api.ts
+function isInternalAuthRejection(body) {
+  try {
+    return JSON.parse(body).error === "Unauthorized";
+  } catch {
+    return false;
+  }
+}
+function replay(res, body) {
+  return new Response(body, { status: res.status, statusText: res.statusText, headers: res.headers });
+}
+async function internalFetch(port, path, init = {}, token) {
+  const candidates = token ? [token] : internalTokenSources().tokens;
+  if (candidates.length === 0) return { kind: "no-token", detail: internalTokenProblem() };
+  const url = `http://127.0.0.1:${port}${path}`;
+  let refused;
+  for (const candidate of candidates) {
+    let res;
+    try {
+      res = await fetch(url, {
+        ...init,
+        headers: {
+          ...init.headers,
+          "X-Internal-Token": candidate
+        }
+      });
+    } catch (err) {
+      return { kind: "unreachable", detail: err.message };
+    }
+    if (res.status !== 401) return { kind: "response", res };
+    const body = await res.text().catch(() => "");
+    if (!isInternalAuthRejection(body)) return { kind: "response", res: replay(res, body) };
+    refused = replay(res, body);
+  }
+  return { kind: "response", res: refused, tokenRejected: true };
+}
+async function internalGet(port, path, token) {
+  const call = await internalFetch(
+    port,
+    path,
+    { signal: AbortSignal.timeout(1e4) },
+    token
+  );
+  if (call.kind !== "response" || !call.res.ok) return null;
+  return await call.res.json().catch(() => null);
+}
+async function internalPost(port, path, body, token) {
+  const call = await internalFetch(
+    port,
+    path,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(3e4)
+    },
+    token
+  );
+  if (call.kind !== "response") return { ok: false, data: { error: call.detail } };
+  const data = await call.res.json().catch(() => ({}));
+  if (call.tokenRejected && !token) {
+    return { ok: false, data: { ...data, error: internalTokenRejectedProblem() } };
+  }
+  return { ok: call.res.ok, data };
+}
+async function bootstrapAdmin(apiPort, admin, token) {
+  const { ok, data } = await internalPost(apiPort, "/api/system/bootstrap-admin", admin, token);
+  if (ok) return { ok: true };
+  if (data?.error === "An admin account already exists") return { ok: true, message: "already-exists" };
+  return { ok: false, message: data?.error || "failed" };
+}
+async function waitHealthy(apiPort, seconds = 90) {
+  for (let i = 0; i < seconds; i++) {
+    await new Promise((r) => setTimeout(r, 1e3));
+    try {
+      await fetch(`http://127.0.0.1:${apiPort}/api/health`, { signal: AbortSignal.timeout(2e3) });
+      return true;
+    } catch {
+    }
+  }
+  return false;
+}
+async function waitDashboard(dashPort, seconds = 45) {
+  for (let i = 0; i < seconds; i++) {
+    await new Promise((r) => setTimeout(r, 1e3));
+    try {
+      const res = await fetch(`http://127.0.0.1:${dashPort}/`, {
+        redirect: "manual",
+        signal: AbortSignal.timeout(2e3)
+      });
+      if (res.status > 0) return true;
+    } catch {
+    }
+  }
+  return false;
+}
+async function detectPublicIp() {
+  for (const url of ["https://api.ipify.org", "https://ifconfig.me/ip"]) {
+    try {
+      const res = await fetch(url, { signal: AbortSignal.timeout(3e3) });
+      if (!res.ok) continue;
+      const ip = (await res.text()).trim();
+      if (/^[0-9.]+$/.test(ip) || ip.includes(":")) return ip;
+    } catch {
+    }
+  }
+  return null;
+}
+
+// src/lib/edge-import.ts
+async function waitForApiHealth(port, tries) {
+  for (let i = 0; i < tries; i++) {
+    try {
+      const r = await fetch(`http://127.0.0.1:${port}/api/health`, { signal: AbortSignal.timeout(2e3) });
+      if (r.ok) return true;
+    } catch {
+    }
+    await new Promise((r) => setTimeout(r, 1e3));
+  }
+  return false;
+}
+async function waitForEdgeRunning(tries) {
+  const exec = new LocalExecutor();
+  for (let i = 0; i < tries; i++) {
+    const out = await exec.exec(`docker inspect -f '{{.State.Running}}' ${EDGE_CONTAINER_NAME}`).catch(() => "");
+    if (out.trim() === "true") return true;
+    await new Promise((r) => setTimeout(r, 1e3));
+  }
+  return false;
+}
+async function importMigratedSites(apiPort, sites, certPems, staticRootOverrides) {
+  if (!resolveInternalToken()) {
+    const error = internalTokenProblem();
+    console.log(chalk.yellow(`  Skipping site import \u2014 ${error}. Re-run to retry.
+`));
+    return { ok: false, registered: [], error };
+  }
+  const spinner = ora(
+    `Importing ${sites.length} migrated site${sites.length === 1 ? "" : "s"} into the edge\u2026`
+  ).start();
+  if (!await waitForApiHealth(apiPort, 60)) {
+    const error = "API didn't become healthy in time";
+    spinner.warn(`${error} \u2014 migrated sites not imported. Re-run \`openship up\` to retry.`);
+    return { ok: false, registered: [], error };
+  }
+  if (!await waitForEdgeRunning(60)) {
+    const error = `the ${EDGE_CONTAINER_NAME} container isn't running yet`;
+    spinner.warn(`${error} \u2014 migrated sites not imported. Re-run \`openship up\` to retry.`);
+    return { ok: false, registered: [], error };
+  }
+  try {
+    const call = await internalFetch(apiPort, "/api/system/edge/import-sites", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ sites, certPems, staticRootOverrides }),
+      signal: AbortSignal.timeout(12e4)
+    });
+    if (call.kind !== "response") {
+      spinner.warn(`Site import failed: ${call.detail}. Re-run to retry.`);
+      return { ok: false, registered: [], error: call.detail };
+    }
+    const r = call.res;
+    const data = await r.json().catch(() => ({}));
+    if (!r.ok) {
+      const error = data.error ?? `HTTP ${r.status}`;
+      spinner.warn(`Site import failed: ${error}. Re-run to retry.`);
+      return { ok: false, registered: [], error };
+    }
+    const registered = data.registered ?? [];
+    const warnings = data.warnings ?? [];
+    const missed = sites.length - registered.length;
+    if (sites.length > 0 && registered.length === 0) {
+      spinner.fail(
+        `Migrated NONE of the ${sites.length} site${sites.length === 1 ? "" : "s"} \u2014 Openship holds :80/:443 and ${sites.length === 1 ? "that hostname is" : "those hostnames are"} NOT being served.`
+      );
+      for (const w of warnings.slice(0, 8)) console.log(chalk.red(`    \u2022 ${w}`));
+      const edgeLog = await edgeCrashReason(new LocalExecutor());
+      if (edgeLog) {
+        console.log(chalk.red(`
+  The edge container is not running. Its log says:`));
+        console.log(chalk.red(`    ${edgeLog}`));
+      }
+      const back = startUnitHint("nginx");
+      console.log(
+        chalk.yellow(
+          `
+  Retry the import with \`openship up\` once the cause above is fixed, or put your
+` + (back ? `  previous proxy back:  docker stop ${EDGE_CONTAINER_NAME} && ${back}
+` : `  previous proxy back by stopping ${EDGE_CONTAINER_NAME} and starting it the way
+  this host starts services.
+`)
+        )
+      );
+      return { ok: false, registered, error: warnings[0] ?? "no sites were registered" };
+    }
+    if (missed > 0) {
+      spinner.warn(
+        `Migrated ${registered.length}/${sites.length} sites \u2014 ${missed} not served (see below).`
+      );
+      for (const w of warnings.slice(0, 8)) console.log(chalk.yellow(`    \u2022 ${w}`));
+      return { ok: false, registered, error: `${missed} site(s) not registered` };
+    }
+    spinner.succeed(
+      `Migrated ${registered.length} site${registered.length === 1 ? "" : "s"} into Openship's edge.`
+    );
+    for (const w of warnings.slice(0, 8)) console.log(chalk.dim(`    \u2022 ${w}`));
+    return { ok: true, registered };
+  } catch (e) {
+    const error = e.message;
+    spinner.warn(`Site import failed: ${error}. Re-run to retry.`);
+    return { ok: false, registered: [], error };
+  }
+}
+
+export {
+  mintBareInternalToken,
+  internalTokenRejectedProblem,
+  internalFetch,
+  internalGet,
+  internalPost,
+  bootstrapAdmin,
+  waitHealthy,
+  waitDashboard,
+  detectPublicIp,
+  waitForApiHealth,
+  waitForEdgeRunning,
+  importMigratedSites
+};